Security News > 2021 > May > Microsoft: Business email compromise attack targeted dozens of orgs

Microsoft detected a large-scale business email compromise campaign that targeted more than 120 organizations using typo-squatted domains registered a few days before the attacks started.

BEC scammers use various tactics to compromise business email accounts, later used to redirect payments to bank accounts under their control or target employees in gift card scams.

"We observed patterns in using the correct domain name but an incorrect TLD, or slightly spelling the company name wrong. These domains were registered just days before this email campaign began," the Microsoft 365 Defender Threat Intelligence Team said.

Despite the scammers' efforts to match the spoofed domains to the right target, Microsoft "The registered domains did not always align with the organization being impersonated in the email."

"Filling these headers in made the email appear legitimate and that the attacker was simply replying to the existing email thread between the Yahoo and Outlook user," Microsoft added.

"This characteristic sets this campaign apart from most BEC campaigns, where attackers simply include a real or specially crafted fake email, adding the sender, recipient, and subject, in the new email body, making appear as though the new email was a reply to the previous email."

News URL

https://www.bleepingcomputer.com/news/security/microsoft-business-email-compromise-attack-targeted-dozens-of-orgs/