Legitimate SharePoint notifications used for phishing

Issue 2/3 2023 News & Events, Information Security

To hunt for corporate credentials, cybercriminals now hide phishing links in a file on a hijacked SharePoint server and distribute them using a native notification mechanism. Such emails are better at bypassing spam filters and seem more convincing, especially if the company uses this service.

Recently, Kaspersky experts observed more than 1600 malicious notifications with potential victims in Europe, North America, and other regions. Although the scale of the attacks is not massive yet, companies should be aware of the new scheme and mitigate risks in advance.

Spam filters are almost always capable of detecting phishing emails with a link in the body of the letter, so cybercriminals are constantly refining their tools to try bypassing security solutions. Now, they don’t just hide phishing links on a SharePoint server, as in previously known schemes, but they distribute it using legitimate SharePoint notifications.

This ploy using legitimate notifications lulls the vigilance of even tech-savvy employees. Notifications are sent on behalf of a real company’s services, and they do not raise doubts, especially if the company uses SharePoint as part of its everyday routine.

How phishing via SharePoint notifications works

An employee receives a standard SharePoint notification saying that someone has shared a OneNote file with them. This email is absolutely legitimate and can bypass the spam filter more easily than a phishing link hidden on a SharePoint server.

An employee follows the link, where the OneNote file mentioned opens, but the body of the note contains another ‘notification’ with a huge icon of a different type of file (for example, PDF) and a standard phishing link.

This phishing link leads to a phishing website that mimics the Microsoft OneDrive login page. Cybercriminals use it to steal the credentials for various email accounts, such as Yahoo!, AOL, Outlook, Office 365, and others.

How companies can mitigate risks against this type of phishing

Although such phishing letters are convincing, they are distinguishable by an array of red flags that can be explained to employees.

"To begin with, the file is unknown as well as the sender. Colleagues don’t normally share documents without an intro. There are more red flags: a link to the OneNote file in the notification and PDF-file appears on the server out of the blue. Furthermore, the download link leads to a third-party site, and the web address has nothing to do with the victim's organisation or SharePoint server. The phishing site mimics login page for OneDrive, which is another Microsoft service that is not related to SharePoint. To stay safe, it is necessary to use caution with all suspicious emails and watch out for such inconsistencies," explains Roman Dedenok, Spam Analysis Expert at Kaspersky.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Pentagon appointed as Milestone distributor
Elvey Security Technologies News & Events Surveillance
Milestone Systems appointed Pentagon Distribution (an Elvey Group company within the Hudaco Group of Companies) as a distributor. XProtect’s open architecture means no lock-in and the ability to customise the connected video solution that will accomplish the job.

SMART Estate Security returns to KZN
Nemtek Electric Fencing Products Technews Publishing Axis Communications SA OneSpace Editor's Choice News & Events Integrated Solutions IoT & Automation
The second SMART Estate Security Conference of 2024 was held in May in KwaZulu-Natal at the Mount Edgecombe Estate Conference Centre, which is located on the Estate’s pristine golf course.

From the editor's desk: Just gooi a cable
Technews Publishing News & Events
      Welcome to the 2024 edition of the SMART Estate Security Handbook. We focus on a host of topics, and this year’s issue also has a larger-than-normal Product Showcase section. Perhaps the vendors are ...

Secutel wins OSPA Award for Outstanding New Security Product
Secutel Technologies News & Events Access Control & Identity Management
[Sponsored] Secutel Technologies’ NoKey Access Control solution won the Outstanding New Security Product category at the 2024 OSPAs in South Africa. The awards were presented at Securex 2024 where all category finalists were recognised for their contribution to the security industry.

ONVIF launches new working groups for cloud, metadata and audio
News & Events Surveillance
ONVIF, the global standardisation initiative for IP-based physical security products, is announcing the formation of three new working groups to tackle standardisation work in cloud connectivity, audio, and advanced metadata.

Inaugural Gallagher Security Johannesburg networking roadshow
Gallagher News & Events
Held at Johannesburg’s Foghound Coffee Company in Midrand from 11 to 12 June, security industry professionals gather at the inaugural Gallagher Security Johannesburg Networking Roadshow.

Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Dallmeier receives ISO 27001 certification
Dallmeier Electronic Southern Africa Surveillance News & Events
Dallmeier has received ISO 27001 certification for its Information Security Management System (ISMS). The international standard for information security management ensures that companies meet the highest standards of data protection and data security.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

Local manufacturing is still on the rise
Hissco Editor's Choice News & Events Security Services & Risk Management
HISSCO International, Africa's largest manufacturer of security X-ray products, has recently secured a multi-continental contract to supply over 55 baggage X-ray screening systems in 10 countries.