{"id":21149,"date":"2020-06-06T20:40:00","date_gmt":"2020-06-06T20:40:00","guid":{"rendered":"https:\/\/icrowdnewswire.com\/?p=2585113"},"modified":"2020-06-06T20:40:00","modified_gmt":"2020-06-06T20:40:00","slug":"fake-vpn-messages-used-to-lure-office-365-phishing-victims","status":"publish","type":"post","link":"https:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/","title":{"rendered":"Fake VPN messages used to lure Office 365 phishing victims"},"content":{"rendered":"<p><strong>Hackers continue to target employees working from home<\/strong><\/p>\n<p>A new phishing campaign is targeting Office 365 customers by impersonating their organizations in messages telling them they need to update their&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/vpn\/best-vpn\" data-component-tracked=\"1\" data-dimension73=\"7262036427197490000\">VPN<\/a>&nbsp;configuration while working remotely.<\/p>\n<p>The phishing emails used in the campaign are made to look as if they come from an organization&#8217;s IT support department in an effort to lure employees into opening them. According to the email security firm Abnormal Security, so far 15,000 targets have received these convincing phishing emails.<\/p>\n<aside class=\"hawk-widget\" data-render-type=\"fte\" data-skip=\"dealsy\" data-widget-type=\"seasonal\" data-widget-id=\"1106599247696442100\" data-result=\"missing\"><\/aside>\n<p>VPN usage has soared with more employees&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/news\/working-from-home-everything-you-need-to-set-up-your-new-home-office\" data-component-tracked=\"1\" data-dimension73=\"9878831587778623000\">working from home<\/a>&nbsp;than ever before as a result of the pandemic which is why this and other recent phishing campaigns have been so effective. Employees rely on VPNs as a means to connect to their company servers and access sensitive data while working remotely.<\/p>\n<h2 id=\"office-365-credentials\">Office 365 credentials<\/h2>\n<p>The attackers behind this campaign have gone to great lengths to make not only their phishing emails but also their phishing landing pages more convincing.<\/p>\n<p>For starters, the attackers are spoofing the sender email address in their phishing emails to match the domain of targets&#8217; organizations. The VPN configs sent in these emails actually take users to a phishing landing page that accurately impersonates Microsoft&#8217;s&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/reviews\/pc-mac\/software\/home-and-reference-software\/microsoft-office-365-980626\/review\" target=\"_blank\" rel=\"noopener noreferrer\" data-component-tracked=\"1\">Office 365<\/a>&nbsp;login page. This fake login page is also hosted on a domain owned by Microsoft.<\/p>\n<p>By abusing the Azure Blob Storage platform, the attackers have made it so their landing page has a valid Microsoft certificate that displays the secure padlock since they are using a web.core.windows.net wildcard SSL certificate. Most users would see that the certificate was issued by Microsoft and not even think twice about entering their Office 365 credentials.<\/p>\n<p>In a&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/abnormalsecurity.com\/blog\/abnormal-attack-stories-vpn-impersonation-phishing\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-original-href=\"https:\/\/abnormalsecurity.com\/blog\/abnormal-attack-stories-vpn-impersonation-phishing\/\" data-component-tracked=\"1\">blog post<\/a>, Abnormal Security warned that this campaign is widespread and that numerous versions of this attack have been spotted in the wild, saying:<\/p>\n<p>&ldquo;Numerous versions of this attack have been seen across different clients, from different sender emails and originating from different IP addresses. However, the same payload link was employed by all of these attacks, implying that these were sent by a single attacker that controls the phishing website.&rdquo;<\/p>\n<p>To avoid falling victim this campaign, users should only enter their Office 365 credentials on official login pages hosted by Microsoft on its microsoft.com, live.com or outlook.com domains.<\/p>\n<p class=\"tags\">\n<div><strong>See Campaign: <\/strong><a href=\"http:\/\/http:\/\/www.techradar.com\/news\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\" target=\"_blank\">http:\/\/http:\/\/www.techradar.com\/news\/fake-vpn-messages-used-to-lure-office-365-phishing-victims<\/a><br \/><b>Contact Information:<\/b><br \/>Anthony Spadafora <\/p>\n<p><b>Tags:<\/b><br \/><a href=\"\"><\/a>, <a href=\"https:\/\/icrowdnewswire.com\/category\/news-category\/wire\/\" rel=\"category tag\">Wire<\/a>, <a href=\"https:\/\/icrowdnewswire.com\/category\/global-regions\/united-states\/\" rel=\"category tag\">United States<\/a>, <a href=\"https:\/\/icrowdnewswire.com\/category\/language\/english\/\" rel=\"category tag\">English<\/a><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"\" alt=\"image\" width=\"400\" height=\"300\" class=\"cwdfimg\" \/><\/div>\n<div>\n<h3>Contact Information:<\/h3>\n<p>Anthony Spadafora <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Hackers continue to target employees working from home A new phishing campaign is targeting Office 365 customers by impersonating their organizations in messages telling them they need to update their&nbsp;VPN&nbsp;configuration while working remotely. The phishing emails used in the campaign are made to look as if they come from an organization&rsquo;s IT support department in &hellip; <a href=\"https:\/\/icrowdnewswire.com\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\">Continue reading <span>Fake VPN messages used to lure Office 365 phishing victims<\/span><\/a> <a href=\"https:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\" class=\"more-link\">Continue Reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":106,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,22,54],"tags":[],"class_list":["post-21149","post","type-post","status-publish","format-standard","hentry","category-english","category-united-states","category-wire"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Fake VPN messages used to lure Office 365 phishing victims - Business<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fake VPN messages used to lure Office 365 phishing victims - Business\" \/>\n<meta property=\"og:description\" content=\"Hackers continue to target employees working from home A new phishing campaign is targeting Office 365 customers by impersonating their organizations in messages telling them they need to update their&nbsp;VPN&nbsp;configuration while working remotely. The phishing emails used in the campaign are made to look as if they come from an organization&rsquo;s IT support department in &hellip; Continue reading Fake VPN messages used to lure Office 365 phishing victims Continue Reading &rarr;\" \/>\n<meta property=\"og:url\" content=\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\" \/>\n<meta property=\"og:site_name\" content=\"Business\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-06T20:40:00+00:00\" \/>\n<meta name=\"author\" content=\"Waqas Awan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Waqas Awan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\",\"url\":\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\",\"name\":\"Fake VPN messages used to lure Office 365 phishing victims - Business\",\"isPartOf\":{\"@id\":\"https:\/\/ipsnews.net\/business\/#website\"},\"datePublished\":\"2020-06-06T20:40:00+00:00\",\"author\":{\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f\"},\"breadcrumb\":{\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ipsnews.net\/business\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fake VPN messages used to lure Office 365 phishing victims\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ipsnews.net\/business\/#website\",\"url\":\"https:\/\/ipsnews.net\/business\/\",\"name\":\"Business\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ipsnews.net\/business\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f\",\"name\":\"Waqas Awan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g\",\"caption\":\"Waqas Awan\"},\"sameAs\":[\"https:\/\/icrowdnewswire.com\/fc\"],\"url\":\"https:\/\/ipsnews.net\/business\/author\/waqas-awan\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fake VPN messages used to lure Office 365 phishing victims - Business","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/","og_locale":"en_US","og_type":"article","og_title":"Fake VPN messages used to lure Office 365 phishing victims - Business","og_description":"Hackers continue to target employees working from home A new phishing campaign is targeting Office 365 customers by impersonating their organizations in messages telling them they need to update their&nbsp;VPN&nbsp;configuration while working remotely. The phishing emails used in the campaign are made to look as if they come from an organization&rsquo;s IT support department in &hellip; Continue reading Fake VPN messages used to lure Office 365 phishing victims Continue Reading &rarr;","og_url":"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/","og_site_name":"Business","article_published_time":"2020-06-06T20:40:00+00:00","author":"Waqas Awan","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Waqas Awan","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/","url":"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/","name":"Fake VPN messages used to lure Office 365 phishing victims - Business","isPartOf":{"@id":"https:\/\/ipsnews.net\/business\/#website"},"datePublished":"2020-06-06T20:40:00+00:00","author":{"@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f"},"breadcrumb":{"@id":"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/ipsnews.net\/business\/2020\/06\/06\/fake-vpn-messages-used-to-lure-office-365-phishing-victims\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ipsnews.net\/business\/"},{"@type":"ListItem","position":2,"name":"Fake VPN messages used to lure Office 365 phishing victims"}]},{"@type":"WebSite","@id":"https:\/\/ipsnews.net\/business\/#website","url":"https:\/\/ipsnews.net\/business\/","name":"Business","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ipsnews.net\/business\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f","name":"Waqas Awan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g","caption":"Waqas Awan"},"sameAs":["https:\/\/icrowdnewswire.com\/fc"],"url":"https:\/\/ipsnews.net\/business\/author\/waqas-awan\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/21149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/users\/106"}],"replies":[{"embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/comments?post=21149"}],"version-history":[{"count":1,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/21149\/revisions"}],"predecessor-version":[{"id":21150,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/21149\/revisions\/21150"}],"wp:attachment":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/media?parent=21149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/categories?post=21149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/tags?post=21149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}