Microsoft Visio files used to carry out dangerous phishing attacks
New two-step phishing campaign spotted using Microsoft Visio files
- Crooks are embedding malicious links in Microsoft Visio files
- The files are distributed via compromised email accounts
- The goal of the campaign is to steal Microsoft 365 login credentials
Security researchers from Perception Point have spotted a new two-step phishing campaign aiming to steal people’s Microsoft 365 login credentials. It includes compromised email accounts, compromised SharePoint accounts, and some convincing - but fake - purchase orders.
The attack starts with a hacked Microsoft SharePoint account, where the criminals would upload a file using Microsoft Visio - the company's tool for making professional diagrams and charts, creating files with the .VSDX extension.
The crooks would embed a malicious URL in this file leading to a fake Microsoft 365 login page. Victims that make it this far usually try to log into their accounts, thus sharing the login credentials with the attackers.
Abusing people's email accounts
Then, the attackers would compromise someone’s email account, and use it to distribute the phishing messages. Since these emails would be coming from otherwise legitimate sources, they are very likely to make it past any email security protections. The body of the message itself is your usual phishing content, sharing a fake purchase order, or something similar.
In some cases, the crooks would also share another email message as an attachment (.EMI files), all in an attempt to hide the malicious intent lurking in the SharePoint account. When it comes to obfuscations, the crooks added another layer in the Visio file itself - the call to action leading to the fake login page can only be clicked while holding the Control (CTRL) button on the keyboard.
“Asking for the Ctrl key press input relies on a simple interaction that a human user can perform, effectively bypassing automated systems that are not designed to replicate such behaviors,” Perception Point explained in its research.
We don’t know exactly how many companies were targeted, or fell victim to this attack, but the researchers claim they are in the hundreds, and are located all around the world.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
You might also like
- Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
- Here's a list of the best firewalls today
- These are the best endpoint protection tools right now
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.