Phishing Email Alerts
Catch of the Day: Mailbox Full Phish
Chef’s Special: AitM Phish
Examples of clever phish that made it past my spam filters and into my inbox. Some are sent by clients or readers like you, and other reliable sources on the Internet.
You can send phishing samples to me at phish@wyzguys.com.
My intention is to provide a warning and show current examples of phishing scams, related articles, and education about how these scams and exploits work, and how to detect them in your inbox. If the pictures are too small or extend off the page, double clicking the image will display them in a photo viewer app.
Massive adversary-in-the-middle phishing campaign bypasses MFA and mimics Microsoft Office
Microsoft has already seen millions of phishing emails sent every day by attackers using this phishing kit. Learn how to protect your business from this AitM campaign.
[Bob says: I like Adversary in the Middle better than On Path Attack as the politically correct non-sexist replacement for Man in the Middle.]
Mailbox Full Phish
I’ve been more diligent about analyzing the phish I catch quickly, before the inevitable takedown. This fish arrived at 4:20 am on March 31. Also of the screen captures happened by 6:00 am. The Reduce Mailbox Size button resolved to https://owa0i001.web.app/ which is a public service available from Firebase Hosting. Here’s the email
The email domain is for davisacura.com which looks like a car dealer to me. Here are the email headers
Clicking the link lead to this credential stealing landing page
Virustotal did not report this link as malicious yet, but it appears I may have been the first to report this link.
Viewing the Details tab gave us the IP address of the server 199.36.158.100
This appears to be a Google property. Many exploits like this one use publicly available hosting services. These are often cleaned up within hours of their creation, but the adversaries must get enough usable responses for this to be worthwhile.
Share
APR
About the Author:
I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at http://wyzguyscybersecurity.com