Phishing links hidden inside calendar invite attachments
Cybercriminals have found a new way to reach users' inboxes
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybercriminals continue to devise new ways to deliver phishing emails to end users and theCofense Phishing Defense Center(PDC) had discovered a new phishing campaign which uses calendar invite attachments to try and bypass email gateways.
The firm’s researchers discovered the new campaign in multiple enterprise email environments protected by Proofpoint andMicrosoft. Cofense assumes that the attackers believe that by putting their phishing URL inside a calendar invite, they can avoid automated analysis.
The subject of the phishing emails used in the campaign is “Fraud Detection from Message Center” and the sender display name is Walker. However, the email address used appears to be legitimate and may be from a school district whose accounts were compromised. In fact, Cofense observed the use of severalcompromised accountsin this campaign as using a compromised Office 365 account allows messages to bypass email filters which rely on DKIM/SPF.
The email uses a version of the classic lure “suspicious activity on the user’s bank account” to trick users into opening it. Attached to the email is a calendar invite that contains a link to the fake invitation.
Hiding on legitimate sites
When a user clicks on the calendar invite, they are redirected to a simple document, hosted on Microsoft’sSharepointsite, containing yet another link.
If the victim goes ahead and follows this second link, they are redirected from sharepoint.com to a phishing site hosted byGoogle. However, this is not the first time a cybercriminal has used one of Google’s sites to host their phishing scam and this practice is becoming increasingly common due to its ease of use as well as the built-inSSL certificatethe domain comes with.
Users are then presented with a convincing Wells Fargo banking page that asks for a variety of account information including login details, PIN and various account numbers along with email credentials. If a user does provide all of this information, they will finally be redirected to the actual Wells Fargo login page to make them believe that they have successfully secured their account.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
This latest phishing campaign is yet another reminder that both businesses and individuals need to remain constantly vigilant when checking their emails as cybercriminals continue to find new ways to slip past gateways and deliver their scams to users.
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Dangerous Android banking malware looks to trick victims with fake money transfers
Sophos Firewall hack on government network used an all-new custom malware
The EU AI Act: What do CISOs need to know to strengthen AI security?
