Microsoft Visio files used to carry out dangerous phishing attacks

News
By
published

New two-step phishing campaign spotted using Microsoft Visio files

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
(Image credit: weerapatkiatdumrong / Getty Images)
  • Crooks are embedding malicious links in Microsoft Visio files
  • The files are distributed via compromised email accounts
  • The goal of the campaign is to steal Microsoft 365 login credentials

Security researchers from Perception Point have spotted a new two-step phishing campaign aiming to steal people’s Microsoft 365 login credentials. It includes compromised email accounts, compromised SharePoint accounts, and some convincing - but fake - purchase orders.

The attack starts with a hacked Microsoft SharePoint account, where the criminals would upload a file using Microsoft Visio - the company's tool for making professional diagrams and charts, creating files with the .VSDX extension.

The crooks would embed a malicious URL in this file leading to a fake Microsoft 365 login page. Victims that make it this far usually try to log into their accounts, thus sharing the login credentials with the attackers.

Abusing people's email accounts

Then, the attackers would compromise someone’s email account, and use it to distribute the phishing messages. Since these emails would be coming from otherwise legitimate sources, they are very likely to make it past any email security protections. The body of the message itself is your usual phishing content, sharing a fake purchase order, or something similar.

In some cases, the crooks would also share another email message as an attachment (.EMI files), all in an attempt to hide the malicious intent lurking in the SharePoint account. When it comes to obfuscations, the crooks added another layer in the Visio file itself - the call to action leading to the fake login page can only be clicked while holding the Control (CTRL) button on the keyboard.

“Asking for the Ctrl key press input relies on a simple interaction that a human user can perform, effectively bypassing automated systems that are not designed to replicate such behaviors,” Perception Point explained in its research.

We don’t know exactly how many companies were targeted, or fell victim to this attack, but the researchers claim they are in the hundreds, and are located all around the world.

You might also like

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.