The ongoing pandemic of account spoofing and phishing attacks has knocked on the door of Zoom Technology, targeting over 21,000 users of a national healthcare company and bypassing Microsoft Exchange’s email security.
An email was sent from an address similar to the official Zoom email address and claims that the recipient cannot use the service until they click the link in the email to reactivate their account.
The email contains a hidden link in the text that redirects to a page hosted on an unrelated domain. This link leads you to a fake Microsoft login page hosted on a different domain to access the recipient’s Microsoft credentials, which can be used to access a larger ton of confidential material.
The attackers try to exploit people who need to access Zoom but may not notice that the URL has been redirected. Recipients who fall victim to this attack have compromised their Microsoft credentials as well as any other information stored on these accounts.
When an account is compromised, attackers gain access to existing email conversations, files in Microsoft Teams and Microsoft SharePoint, as well as the ability to use this account to send additional email attacks to the victim’s employees, partners and customers.
The attackers attempted to circumvent security measures by sending the email from a legitimate and trusted domain such as Zoom. Moreover, the email was written in such a way that no red flags were raised, either by email security tools or an unsuspecting recipient.
The sources for this piece include an article in TechRepublic.