Security News > 2021 > January > Phishers Target C-Suite with Fake Office 365 Password Expiration Reports
An ongoing phishing campaign delivering fake Office 365 password expiration reports has managed to compromise tens of C-Suite email accounts to date, according to a warning from anti-malware vendor Trend Micro.
The phishers were able to compromise 40 legitimate email addresses of CEOs, directors, company founders, and owners, as well as those of other enterprise employees.
As lures, the attackers used fake Office 365 password expiration reports, requesting the victim to click on an embedded link that would allegedly allow them to continue using the same password.
Compromised infrastructure and stolen credentials are abused to host phishing pages and target more victims.
As part of the attack, the hackers used a phishing kit that was first detailed last year, when used in similar attacks leveraging fake Microsoft login pages.
"Phishing attacks and attackers often target employees - usually the weakest link in an organization's security chain. [] By selectively targeting C-level employees, the attacker significantly increases the value of obtained credentials as they could lead to further access to sensitive personal and organizational information, and used in other attacks," Trend Micro concludes.