Phishing is a sort of attack in which you are tricked into supplying sensitive information in response to a fake message containing malicious links. Phishing is when a fraudster convinces you to do anything that provides them access to your devices, accounts, funds, or confidential information.
Microsoft revealed that there had been a growth in recent phishing email campaigns that use redirecting links combined with CAPTCHA and legitimate appearances, targeting Office 365 accounts. As Office 365 is one of the most widely used cloud business services, threat actors target Office 365 users to extract sensitive information to penetrate business organizations and access their information systems.
As per a 2019 Verizon Report, 94% of malware in all cybercrimes gets delivered via email. Thus, using emails to spread malware is a common cyber-attack strategy. Phishing emails aim to steal sensitive user information under the pretense of seeking identity verification, subscription confirmation, payment, etc. Phishing emails are used to launch various attacks, but the most common ones are BEC scams, spear phishing, whaling, and ransomware attacks.
MS Office 365 is one of the tools used by almost every business organization, regardless of whether it is big or small. It is a multi-system platform that combines functions like email, data storage, collaboration, and seamless integration of productivity applications such as OneDrive and SharePoint.
All these tools are, without doubt, valuable to the users and organizations as it smoothens the functioning of the business. However, such a bulk of user data online at one place makes MS Office 365 a mouthwatering target for phishing scams too.
The time when you’re most vulnerable is when you think you’re not. Think about it. If you think you’re vulnerable, you’re likely to do something about it. But if you think you’re okay, you’re likely to rely on the status quo. And that’s the problem Office 365 users are facing right now. They don’t think they’re vulnerable, but they are.
Office 365 comes with email security native to the application, but it must not be very good. How else can you explain the effort hackers put into exploiting Office 365 users AND the success they’ve had doing it?
According to CPO Magazine, “A new phishing attack is being used to steal user credentials from Microsoft SharePoint and OneDrive users. The attack method is reportedly designed to resemble an ordinary Office 365 permissions page [and] takes on the appearance of a credible Office 365 Add-In.”