Hackers Steal Outlook Passwords Via Overlay Screens on Legitimate Sites

Nowadays, the phishing attacks are increasing at an alarming rate, and these attacks are drastically affecting and harming the business organization. Recently, the cybersecurity researchers have detected a phishing campaign in which the attackers steal outlook passwords via overlay screens on legitimate sites of the targeted company’s homepage.

The Cofense Phishing Defense Center (PDC) had discovered that the phishing campaign started with an attack email that has misrepresented itself as a message quarantine information from all the company’s IT department that has been targeted. 

PDC is a team of experts who are trained to recognize, interpret, respond to, and remediate the phishing attacks that endanger your organization.

While if we talk about the attack, then it’s a new type of attack that has been observed by the experts. All these new techniques in an attack pointed at an unnamed company, and the messages were pretending as the professional support team of the employee’s company.

Attack vector

In this incident, the main motive of this phishing attack is to steal Outlook passwords and concluded that the phishing link was created to draw the homepage of the organization that is involved in the original recipient’s email address.

After not reacting to the emails by the organizations that have been sent by the threat actors, they started to put stress on the target. And here, the threat actor tricks them into communicating with the targeted site via messages. 

It states that two of the messages were contemplated as valid and are being held for deletion. However, to minimize the risk and impact, the Cofense Phishing Defense Center uses the social engineering technique, as it is very efficient and tries to store all the essential documents and communications.  

Most importantly, all the malicious link that has been employed in this phishing campaign have used specific parameters to circumscribe the page pull to use. And after that, they can easily overlay the fake login on top.

The organizations do all possible procedures to secure themselves from this kind of attack. As this type of phishing attacks are new to experts, and they are taking all their time to understand the importance of the attack. 

This kind of attack explains the necessity for businesses to protect themselves against phishing attacks. And therefore, the organizations can protect themselves by doing some initial steps. 

All the organizations should educate their every user regarding some standard phishing campaigns, as it will help them to defend themselves without seeking anybody’s help.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.