Attackers Hijacking Legitimate Websites to Attack Microsoft Teams users

A multi-vector phishing campaign using compromised WordPress sites to steal login credentials from Microsoft Teams and Xfinity users. By hijacking these trusted sites, attackers can bypass security filters and trick victims into disclosing sensitive information.

The threat actors are not relying on a single method to trick their victims. Instead, they are utilizing three distinct phishing lures designed to create a false sense of urgency:

• Teams Voice Message: An email notification claiming the user has a missed voicemail on Microsoft Teams.
• Shared Documents: A deceptive alert stating a new document has been shared, pushing the user to click quickly to view the file.
• UAE Pass Spoofing: A regionally targeted lure that sends fake login requests to users of the UAE Pass digital identity system.

How the Attack Chain Works

The campaign follows a carefully planned attack chain designed to capture user credentials for downstream account takeovers:

The Hook: The victim receives a phishing email, such as a fake “Teams Voice Message” alert, containing a “Listen Now” button.

The Pivot: When the user clicks the link, they are secretly redirected through a tracking domain, specifically skimresources[.]com.

The Payload: The redirect ultimately lands the victim on a highly convincing, pixel-perfect fake login page. These fake pages mimic Microsoft Teams, Xfinity, or UAE Pass.

The Goal: Once the user enters their username and password, attackers harvest the credentials to completely take over the victim’s accounts.

A key feature of this campaign is the abuse of legitimate WordPress websites.

The attackers are hacking into poorly secured sites and hiding their malicious phishing pages deep within standard system folders.

By placing their fake login pages in core directories like /wp-includes/ or /bin/, the attackers can hide in plain sight, avoiding immediate detection by website owners and automated security scanners.

Security teams and network administrators should block the following compromised domains and file paths associated with this campaign:

• crsons[.]net/wp-includes/js/tinymce/~
• crsons[.]net/wp-includes/cgi/UAE%20PASS.htm
• afghantarin[.]com/afghantarin/admin/waitme/~
• medinex[.]in/includes/bin/index[.]php
• cabinetzeukeng[.]net/config/[.]bin/voicemail
• rnedinex[.]com

To protect against this threat, organizations should train employees to carefully verify email senders and hover over links before clicking, especially when receiving unexpected voicemails or document alerts.

Additionally, website administrators must ensure their WordPress installations, themes, and plugins are fully updated to prevent their infrastructure from being weaponized.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.