Internet attackers keep on finding more ways to attack businesses and organisations. The latest trend is to target Office 365 users with fake voicemail messages. Attackers will send a message to users pretending to be from Microsoft about a missed voicemail. This way the attackers will try and convince Office 365 users to give up their password.
A new phishing attack has been discovered which has been set up in a very sophisticated way. Attackers use a fairly convincing e-mail from “Microsoft”, a portal that plays a voicemail message and a fake portal for Office 365 which looks exactly like the legitimate portal. The attack focuses on middle management and higher management of organisations in almost every sector.
Article continues under image
How does the Office 365 phishing voicemail attack work
The attack takes place in a few steps. First the victims receive a fake e-mail that seems to come from Microsoft with the message that the user has missed a phone call. This phishing mail occurs as an automated message. The e-mail contains a link to a document online where the beginning of a legitimate sounding voicemail message is played.
The user is then directed to a portal that looks exactly like the Microsoft page used to log into MS Office 365. If a victim enters his or her credentials and the organisation does not use two factor authorisation the attacker has gained instant access to the account. After logging in on the fake portal the user is redirected to the legitimate Office 365 environment assuming that the whole process was legitimate.
What makes this attack different from other phishing attacks is that audio is being used to deliver a sense of urgency so that victims click on a rogue link faster. This makes the attack very efficient and dangerous for the MS Office 365 users.
How to protect yourself against the Office 365 phishing voicemail attack
Apart from the standard advice to make passwords unique and not to click attachments it is very important to use two factor authentication for Office 365. Please see this article for more information about two factor authentication for Office 365. Two factor authentication should be standard practice for organisations however that this still fails to used as standard. Other advice is to block attachments in the .html and .htm formats at top level.
Two Factor Authentication Office 365 Services
Should you require assistance or do you want two factor authentication set up for your business do not hesitate to contact us at Tech-Wales. We are experts in IT security services and Office 365 consultancy. We have fully trained engineers who combine their knowledge with excellent customer services. We can offer our expertise at competitive prices.