Attacker use fake Zoom email to compromise Microsoft user data

Share post:

The ongoing pandemic of account spoofing and phishing attacks has knocked on the door of Zoom Technology, targeting over 21,000 users of a national healthcare company and bypassing Microsoft Exchange’s email security.

An email was sent from an address similar to the official Zoom email address and claims that the recipient cannot use the service until they click the link in the email to reactivate their account.

The email contains a hidden link in the text that redirects to a page hosted on an unrelated domain. This link leads you to a fake Microsoft login page hosted on a different domain to access the recipient’s Microsoft credentials, which can be used to access a larger ton of confidential material.

The attackers try to exploit people who need to access Zoom but may not notice that the URL has been redirected. Recipients who fall victim to this attack have compromised their Microsoft credentials as well as any other information stored on these accounts.

When an account is compromised, attackers gain access to existing email conversations, files in Microsoft Teams and Microsoft SharePoint, as well as the ability to use this account to send additional email attacks to the victim’s employees, partners and customers.

The attackers attempted to circumvent security measures by sending the email from a legitimate and trusted domain such as Zoom. Moreover, the email was written in such a way that no red flags were raised, either by email security tools or an unsuspecting recipient.

The sources for this piece include an article in TechRepublic.

SUBSCRIBE NOW

Related articles

AT&T Fined $13 Million for Supply Chain Data Breach

AT&T has agreed to pay a $13 million fine following a significant data breach that exposed information of...

Supply Chain Attack Weaponizes Communication Devices in Lebanon

A sophisticated supply chain attack has turned everyday communication devices into weapons in Lebanon, marking a new era...

Chinese Botnet “Raptor Train” Infects 260,000 Devices Worldwide

A massive Chinese botnet dubbed "Raptor Train" has been disrupted by the FBI and cybersecurity researchers. This sophisticated...

Multi-year spear-phishing campaign finally caught

U.S. federal prosecutors have indicted Wu Song, a Chinese national employed by state-owned Aviation Industry Corporation of China,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways