Security News > 2021 > May > Microsoft: Business email compromise attack targeted dozens of orgs
Microsoft detected a large-scale business email compromise campaign that targeted more than 120 organizations using typo-squatted domains registered a few days before the attacks started.
BEC scammers use various tactics to compromise business email accounts, later used to redirect payments to bank accounts under their control or target employees in gift card scams.
"We observed patterns in using the correct domain name but an incorrect TLD, or slightly spelling the company name wrong. These domains were registered just days before this email campaign began," the Microsoft 365 Defender Threat Intelligence Team said.
Despite the scammers' efforts to match the spoofed domains to the right target, Microsoft "The registered domains did not always align with the organization being impersonated in the email."
"Filling these headers in made the email appear legitimate and that the attacker was simply replying to the existing email thread between the Yahoo and Outlook user," Microsoft added.
"This characteristic sets this campaign apart from most BEC campaigns, where attackers simply include a real or specially crafted fake email, adding the sender, recipient, and subject, in the new email body, making appear as though the new email was a reply to the previous email."
News URL
Related news
- Microsoft fixes 6 zero-days under active attack (source)
- Microsoft: Exchange Online mistakenly tags emails as malware (source)
- Microsoft says it broke some Windows 10 patching – as it fixes flaws under attack (source)
- Security measures fail to keep up with rising email attacks (source)
- Microsoft Identifies Storm-0501 as Major Threat in Hybrid Cloud Ransomware Attacks (source)
- Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts (source)
- Microsoft fixes Outlook email sending issue for users with many folders (source)