Security News > 2021 > July > Phish Swims Past Email Security With Milanote Pages

The Milanote app, billed as the "Evernote for creatives" by reviewers, has attracted the notice of cybercriminals who are abusing it to carry out credential-stealing campaigns that skate past secure email gateways, researchers said.

According to analysis from Avanan released Thursday, attackers are looking to hook victims by starting off with a simple email.

"The email itself is pretty standard issue," Gil Friedrich, CEO and co-founder of Avanan, told Threatpost in an interview.

Within the firm's telemetry, it examined 1,430 emails that contained a link to Milanote in some form, and 1,367 of them were part of phishing campaigns.

From a cybercriminal point of view, convincing people to click that many times may be a downside to the approach, but the phish isn't flagged by most SEGs or traditional security systems because the malicious URL is buried so deep in the attack chain.

"We're talking to people on Zoom, sharing thoughts on Slack, using whiteboards on Jamboard and thousands of other services. Email is still incredibly important, of course, but there are other places where information is transmitted."

News URL

https://threatpost.com/phish-email-security-milanote/168021/