Some phishing campaigns work by impersonating well-known organizations or brands. If cybercriminals send an email that looks just like one that comes from a company you are familiar with – and possibly even doing business with – then their hook is set. You can either take the bait or delete the email.

Microsoft is a tempting target for cybercriminals to spoof because it has a large number of subscription-based products, like Office, OneDrive, Outlook, and even Windows.

In mid-July, Abnormal Security, which specializes in preventing email fraud, discovered two different attacks designed to trap unsuspecting victims with subscription renewal. The crooks impersonated actual email notices from Microsoft. Their goal was to steal sensitive information from the recipients by convincing them that they need to renew their Microsoft Office 365 subscription.

The first campaign consists of an email telling the recipient that Office 365 is now called Microsoft 365 and that they should renew their subscription by a specific due date. The email contains a “Click to Renew” link that takes the recipient to a submission form requesting certain sensitive data, such as name, address, and credit card number.

In the second campaign, the email warns the recipient that their Microsoft 365 subscription has already expired and that by a particular date, they must renew it. A “Renew now” link takes the person to a PayPal page that prompts them to enter their PayPal payment details. (I had to look this up, but I learned that Microsoft does accept PayPal.) Typically, the transaction is processed directly, but in this case, it goes to the criminal’s PayPal account.
In both cases, anyone who took the bait will eventually find their PayPal payment information misappropriated and their Microsoft credentials compromised by the attackers.

Why These Attacks Work

A convincing phishing attack incorporates a variety of elements to trick its recipients. These two campaigns adopt several familiar tactics.

  • Official source. By pretending to look like an automated notice from Microsoft, the email gives the appearance of coming from an official source. As such, the recipients may be more likely to follow the instructions in the email.
  • Sense of urgency. Like any effective marketing campaign, the emails conveyed a sense of urgency by warning the recipient that their Microsoft 365 subscription needs to be renewed or has already expired. Further, both emails gave the recipient only a couple of days to renew before the deadline was up. Because Microsoft Office is considered an essential service by many individuals and small businesses, people may overlook the suspicious signs and quickly click on the link to try to renew.
  • Convincing landing page. Hosted on a web site called “office365family.com,” the landing page for the first campaign uses the Microsoft Office 365 name and branding to appear legitimate. The page also borrows images, links, and a website footer from Microsoft’s actual site. However, there are telltale signs that the page is not legitimate. The fonts are inconsistent and many of the header links are broken.
  • Real URL. The second campaign links to an official PayPal page. Yet, there’s no verification as to the product being purchased, no specific entity or individual as the payee, and no guaranteed transfer of goods.

How to Protect Yourself

To guard yourself against these types of phishing campaigns, take the following steps:

  • Double-check the sender’s name and email address to ensure that they’re coming from legitimate sources – don’t just trust the display name.
  • Double-check the webpage’s URL before signing in. Attackers will frequently hide malicious links in redirects or host them on separate websites that can be reached by safe links. This technique allows them to bypass link scanning within emails by traditional email security solutions.
  • If the web site name looks suspicious, do not enter your credentials! Instead, contact me if you have any questions.
  • Verify the information with your office administrator or IT solutions provider for cloud-based subscriptions.

Analysis

If you ask why anyone would do this, the answer is simple: these campaigns generate significant revenue for little effort. One result is straight-forward, because PayPal provides funds directly to the cyber criminal’s account. The one that gains access to a business’ email account is another way. How? Well with those credentials, they now have a list of all of their contacts. They can see who works for which business and can then craft a third, and more disconcerting scam: Business Email Compromise (BEC) or CEO fraud.

A follow-up campaign will be sent to those contacts attempting to claim missing accounts, or asking for wire transfer payments, or various “we need this funding by this time” emails that use social engineering to convince office administrators and in-house bookkeepers to send money to the stated claimant. Only, these emails are not from who they say they are. According to the FBI’s Internet Crime Complaint Center (IC3), businesses in the United States lost more than $1.7 billion in 2019 to BEC scams.

Protecting your business from this kind of malicious email threat follows similar rules to those I stated above. And I’ll add one more factor to keep yourself and your business safe: If you get an unexpected email that asks you to send funds, CALL the person who is requesting it to confirm they sent it. It takes one minute to make a call. It could save you and your business tens of thousands of dollars.

Thanks, and safe computing!

Look, I know that as a business owner, office administrator, or practice manager you get emails from people that you don’t necessarily immediately recognize. It happens to everyone.

By the same token, you’d be hard pressed to ignore an email that was sent in response to one of yours.

That is unless, of course, you didn’t send the original email.

I was quite surprised to see an email from Ronald Perez telling me about an invoice. More so because he included my text regarding a call I was going to make to him.

Unfortunately, the “original” email is fake.

I always close with the word “Thanks!” and have a closing email signature. Neither of which appear in this email.

Looking very closely at the link, it goes to some confabulated address that I’m sure would attempt to ask for a user ID and a password – if it didn’t first attempt to download a key logger to track my future movements over the internet.

It is the very start of the holiday season, so please look carefully at the emails that you receive – BEFORE you click on the link.

And if someone is asking you to pay for something you didn’t order, simply delete it.

I think that I know my client base well enough to know that the majority of you don’t use Twitter, although you probably do know someone who does (no, I don’t mean that guy who seems to be in the news every day for his posts). Unfortunately, what is happening now with that venue is getting out of control.

In the past few weeks if someone in politics, or in the news media, tweets something that is antithetical to another group’s beliefs, that person’s inbox will be filled to the brim immediately with targeted opposition posts. There are these things called “bots” (short for robots) that are now spewing out antagonist tweets at an unprecedented rate. And they are using Twitter to attempt to change the course of political and social discussions.

We all realize now that the 2016 presidential race was subject to Russian cyber-meddling. Some analysts say that the recent ferocity of the latest assaults is but a mere preview of what could be coming in the 2018 elections. The purpose of these bots is to sow discord, and so far, they are succeeding. While top Russian officials have repeatedly rejected accusations of meddling, the top U.S. intelligence agencies are telling us otherwise.

I’ll certainly bet you never thought the information you got on your mobile device came from a robot programmed to serve up garbage, but it is happening. And now, more than ever before, you now have to question the integrity of the information that you receive. On the one hand, ever since the election Twitter has taken steps to counter false news and kill off fake accounts. On the other, unfortunately, the bots are also getting savvier at dodging detection.

In a recent article about ransomware and the affect it has on small businesses, the author states that “security experts say the first thing to do after a ransomware event is to upgrade security and backup processes.”

I had to read that twice before I realized how true it was and how erroneous the statement is.  If an IT consultant is taking these steps after the fact, then they have failed to adequately protect their client.  I cannot see working that way – it is backwards, last generation thinking.

You want to engage with an IT consultant who prepares an entire range of security measures for blocking the possibility of ransomware from affecting your small business in the first place.  Implementing heightened security and backup after the fact won’t cut it; security measures have to be implemented before a calamity occurs.

A new proverb in our industry states that “there’s at least one employee in the office that will click on anything.”  And because that is more often true than not, you need more than the standard list of preventative measures in place, which consist of:

  • Making sure you are running a robust security solution (Internet security, anti-virus, and anti-malware)
  • Keeping the operating system up-to-date
  • Avoiding the use of plug-ins (such as Java, Adobe Flash, and Silverlight) in your web browsers
  • Being careful with email attachments and links in emails from people you don’t know

While those steps are usually issued to help safeguard home users, a small business owner also needs to include the following elevated measures:

  • Employing an advanced Unified Threat Management device (firewall)
  • Enabling server and desktop back-up to a local device and the cloud

These additional factors should help obviate the statement made by the sources for the article’s author.

However, the most important step any security-conscious IT consultant must take is to ensure that appropriate employee education takes place on a regular basis.  This is because the ransomware threat landscape is constantly evolving. Cybercriminals have found a highly effective and lucrative approach to illegally making money.  As new forms of socially engineered threats appear, employees must be reminded and their awareness must be sharpened to distinguish between a valid email and a new phishing threat.

If you want this kind of training for your staff, contact me for further information.  Don’t be a victim to ransomware!

The last thing in the world I want to hear from a client is, “I did something really stupid,” because sometimes I am inclined to agree with them.  This was the case the other day.  I received a very distraught call in the middle of the afternoon. My client sputtered, “I should have known better, but I just wasn’t thinking.”  She went on to tell me that she received a phone call from someone who alerted her to the fact that something was wrong with her computer and that he had to remote in to fix it.

What makes this situation a bit puzzling is that she uses a Mac, and most of these fake callers say they are from Microsoft.  Now for the truly terrifying part:  She proceeded to let a complete stranger remotely access her computer for about an hour.

I won’t go into the recriminations she must be feeling.  While I tried to offer as much comfort as possible, I am quite embarrassed that one of my clients would not think to call me, or at least tell the person calling that “I already have a computer guy who takes care of this for me.”  But that is not the point of this security brief.  I need to concentrate your attention on what has to happen after this atrocious event.

Read More →

There is a reason I send out regular security bulletins explicitly warning about malicious email activity and instructing you, my clients, to call me before you do anything that could have serious repercussions.  That is because there is really bad stuff out there!

I received a voice mail from a client saying she received an email from her accountant and it contained instructions for using Dropbox.  (Dropbox is a file hosting service that offers cloud storage and file synchronization.)  When I listened to the recording, I wasn’t sure if she couldn’t follow the instructions or if she couldn’t get Dropbox to open.  Needless to say, she sent the email to her son, and he couldn’t get it to work either.

Then she called her accountant, who told her he didn’t send it, but that other clients also received the email.  After all of that, she ended her message asking me if her computer was OK.

Well, that was a tough question to answer.  Just the same I was able to conduct some forensics into what occurred with this email – and it was most certainly malicious.

Here is the text of the problematic email (unfortunately I couldn’t capture the header information).

apr1

Now, I don’t know how many times I have told you not to click on links from people you don’t know, but that wasn’t the case here. This sender (whose name has been erased) is known to the recipient. However, I strongly doubt that any business person she knows uses arbitrary capitalization like this. I also doubt a professional would ever send an invoice labeled as a “doc” file with a “jpg” file type.
Read More →

I had purchased software earlier that day, so when an email from American Express Customer Service appeared, I wasn’t surprised.  What astonished me though, was the message:  “For your security, new charges on the accounts listed above may be declined.”  Hmm, there was a minor problem processing the transaction, maybe that’s it.

Looks real, doesn’t it?

AmexSpoof

Nope, this is fake.  What’s missing from this email?  My name, the last four digits of my card, and a phone number…  The link goes to http://american-progrecs.com/americanexpress/.  Investigation shows this to be a web site registered in China, but operating out of Romania!

This is very dangerous, so it bears repeating:  Do NOT click on a link from any email you get regarding “security,” because it is — more than likely — a phishing attempt.

Any questions?  Send me an email.