Cybersecurity firm Proofpoint has issued a warning about a new and sophisticated phishing campaign that is actively targeting Microsoft 365 users.
The attacks are bypassing a key security measure called multi-factor authentication (MFA) to steal sensitive login credentials.
Hackers are creating convincing, but fake, Microsoft applications that impersonate well-known companies like RingCentral, Adobe, and DocuSign. These malicious apps are then used as a lure in phishing emails. When a user clicks on a link, they are taken to what looks like a legitimate Microsoft sign-in page, designed to trick them into entering their username and password.
Even more worryingly, the criminals are using special software known as ‘attacker-in-the-middle’ (AiTM) kits, which can steal a user’s security token in real time. This allows them to bypass MFA, a defence that many organisations rely on to protect accounts.
Microsoft has released new updates to its 365 platform which are expected to make this type of attack more difficult. However, Proofpoint is urging organisations to be extra vigilant and to educate their employees on the dangers of this new threat. They also recommend using stronger security measures like FIDO-based security keys.
Proofpoint is based iCalifornia, but has a global presence with offices in multiple countries, including Australia, Canada, France, Germany, Ireland, Israel, Japan, Netherlands, Singapore, UAE, and the UK.
