Traditional security awareness training often teaches users to analyze URLs and language and design inconsistencies in phishing sites. Attackers know this approach and continually evolve their tactics to bypass these defenses.
The StrongestLayer Threat Intelligence Team has observed one such shift in real time.
A sophisticated phishing campaign targeting Microsoft users by leveraging legitimate Microsoft infrastructure and JavaScript to fool users.
This blog analyzes how this phishing technique works and highlights the importance of building user resilience against such evolving threats.
Indicators of Compromise (IOCs)
- hxxps[:]//microsoft-ownership-verification[.]xxxxxxxx[.]workers[.]dev
- hxxps[:]//microsoft-ownership-verification[.]xxxxxxxx[.]workers[.]dev/jsdisabled
- hxxps[:]//microsoft-identity-verification[.]xxxxxxxx[.]workers[.]dev/
- hxxps[:]//microsoft-identity-verification[.]xxxxxxxx[.]workers[.]dev/jsdisabled
The Attack Breakdown
In this phishing campaign, the attackers redirect users to legitimate Microsoft sites after extracting their credentials.
They use JavaScript hosted on genuine Microsoft domains to deceive users. Making it more challenging to identify the phishing attempt.
Example
A user visits a spoofed version of login.live.com. A security-aware user does recognize the presence of “Microsoft” in the URL and proceed without hesitation.
However, the attackers take it further. When JavaScript is disabled, the site prompts users to enable it. The standard and seemingly harmless request. Meanwhile, enabling JavaScript activates the malicious script hidden within the site, which drains the user’s credentials without raising any alarms.
A Closer Look at the Code
Strongestlayer investigation revealed layers of deception, starting with obfuscated JavaScript designed to dodge detection.
One particularly concerning script cover up was a legitimate Microsoft infrastructure file. JSON configuration which initiates the phishing process.
One of the scripts, “ConvergedLogin,” was hosted on aadcdn.msftauth.net, a legitimate Microsoft domain. It is a calculated move by attackers to mislead even well-aware users who manually check URLs.
As a result of this attack, users are seamlessly taken from the phishing site to the actual Microsoft domains. Concealing the fact that their credentials have already been stolen.
Vital Technical Details About Microsoft Phishing Campaigns
- JavaScript Obfuscation: Attackers used obfuscated JavaScript to avoid detection.
- Seamless Redirection: After capturing user credentials, the site redirects victims to legitimate Microsoft URLs, such as www.office.com, making it appear as if nothing suspicious has happened ever.
- Session Hijacking: The phishing site hijacks the user’s active Microsoft session ID, allowing the attackers to mimic the user in real time without arousing suspicion.
How Does this Advanced Microsoft Phishing Campaign Work?
- Initial Visit: The user navigates to a fake Microsoft login page.
- Credential Harvesting: The site prompts users to enable JavaScript, which triggers the credential-harvesting script.
- Seamless Redirect: After the credentials are stolen, the user is redirected to a legitimate Microsoft page.
- Stealthy Session Hijack: Attackers use stolen credentials to hijack the user’s session, gaining unauthorized access without alerting the user or the SOC.
Why Is This Phishing Attack Effective?
Traditional phishing defenses include teaching users to check for inconsistent URLs or design flaws. They are increasingly insufficient.
This attack capitalizes on legitimate Microsoft infrastructure and sophisticated JavaScript manipulation to fly under the radar.
A well-trained user may know to check URLs.
Still, in this case, the phishing site uses Microsoft domains, making identifying the scam almost impossible.
The sophistication of this attack lies in its ability to seamlessly transition from phishing sites to legitimate domains, exploiting users’ trust in familiar infrastructure.
Building Resilience: Practical Steps for Users and Organizations
Despite the sophistication of this attack, it still fundamentally relies on human interaction. Here are some actionable steps to help users and organizations protect against such advanced phishing campaigns:
- Enable Multi-Factor Authentication (MFA)
MFA is one of the most effective tools against phishing. Even if attackers steal your credentials. They still do need the second factor to gain access. - Be Wary of JavaScript Requests
Users should be cautious when prompted to enable JavaScript on unknown sites. If a site asks to allow it for no reason. It’s worth investigating further or reporting it. - Regular Phishing Simulations
Conduct frequent phishing simulations that replicate real-world tactics like these to train users. Testing how users respond to increasingly sophisticated attacks can highlight gaps in awareness. - Monitor User Behavior with SOC
Organizations should empower their Security Operations Centers (SOC) with tools that allow them to monitor unusual user behavior. Even when traffic appears to go through legitimate domains like Microsoft. - Educate Users Beyond URL Analysis
Awareness training should focus on evolving phishing techniques. Instead of just teaching users to analyze URLs, teach them about JavaScript prompts, unusual redirects, and multi-stage attacks.
Final Thoughts
This sophisticated Microsoft phishing campaign is a stark reminder that attackers continuously evolve their techniques to exploit users’ trust in legitimate infrastructure.
By carefully studying these methods and emphasizing the importance of building user resilience, we can strengthen our first line of defense: security-conscious users.
Security is not just about technology. It’s about empowering users with the right tools, knowledge, and resilience to defend themselves against ever-changing threats. In the ongoing battle against cyber attacks, user resilience remains one of the most potent weapons in our arsenal.
Key Takeaways
- Sophisticated Phishing Tactics: Attackers are leveraging legitimate Microsoft infrastructure to deceive users.
- Seamless Transition to Legitimate Sites: Users are redirected to legitimate pages after credentials are stolen.
- Building User Resilience: Empower users with awareness training beyond URL analysis and implement technologies like MFA to protect against phishing.
Frequently Asked Questions (FAQs)
- What makes Microsoft’s phishing campaign different from traditional phishing attacks?
This phishing campaign is more advanced as it uses legitimate Microsoft domains and obfuscated JavaScript to trick users.
Unlike traditional phishing, which relies on suspicious URLs or poor design, this attack redirects users to legitimate Microsoft infrastructure after extracting their credentials, making it harder to detect. - How does Microsoft phishing attack work?
The phishing attack begins with users being directed to a spoofed Microsoft login page. Once users enter their credentials.
The attackers hijack the active Microsoft session and seamlessly redirect them to a legitimate site like www.office.com or login.live.com. Making the attack invisible to the end user and SOC analysts. - Why is this phishing campaign harder to detect?
This phishing campaign is brutal to detect because it cleverly uses legitimate Microsoft domains and JavaScript to hide malicious actions.
Users trained to look for suspicious URLs or website inconsistencies may not notice anything wrong. Because the attack uses actual Microsoft infrastructure to mask the phishing activity. - How can users protect themselves from such advanced phishing campaigns?
Users should be cautious of unexpected login prompts and requests to enable JavaScript on unfamiliar sites. Organizations should implement multi-factor authentication (MFA) and use behavioral detection systems.
It identifies unusual login activity. Regularly educating users about sophisticated phishing tactics and maintaining a zero-trust security approach can also help mitigate these attacks. - How do SOC teams detect this type of phishing attack?
SOC teams must look beyond traditional URL filtering and focus on anomalous behavior patterns. These patterns matter the most in this technological warfare.
Monitoring for unusual session hijacking activities, cross-domain redirects, and unexpected JavaScript activity can help detect these sophisticated phishing attempts. Advanced threat detection tools that analyze traffic patterns to legitimate domains can also help in early detection. - How can organizations build resilience against such advanced phishing attacks?
Organizations must shift their focus from static security awareness training to building a more security-conscious culture. That is why StrongestLayer is here.
StrongestLayer helps recognize deceptive tactics like session hijacking, utilizing continuous monitoring, and implementing outcome-driven security metrics to measure success in risk mitigation.