Security News > 2023 > May > Phishers use encrypted file attachments to steal Microsoft 365 account credentials
Phishers are using encrypted restricted-permission messages attached in phishing emails to steal Microsoft 365 account credentials.
"The initial emails are sent from compromised Microsoft 365 accounts and appear to be targeted towards recipient addresses where the sender might be familiar."
The phishing emails are sent from a compromised Microsoft 365 account to individuals working in the billing department of the recipient company.
Phishing email with a encrypted restricted-permission message.
"The use of encrypted.rpmsg messages means that the phishing content of the message, including the URL links, are hidden from email scanning gateways. The only URL link in the body of the message points to a Microsoft Encryption service," Hay and Mendez noted.
"The only clue that something might be amiss is the URL has a specified sender address unrelated to the From: address of the email. The link was likely generated from yet another compromised Microsoft account."
- Microsoft 365 phishing attacks use encrypted RPMSG messages (source)
- Capita cyberattack disrupted access to its Microsoft Office 365 apps (source)
- Microsoft 365 outage blocks access to web apps and services (source)
- Microsoft 365 search outage affects Outlook, Teams, and SharePoint (source)
- New Microsoft 365 outage causes Exchange Online connectivity issues (source)
- New 'Greatness' service simplifies Microsoft 365 phishing attacks (source)
- Greatness phishing-as-a-service threatens Microsoft 365 users (source)
- Microsoft 365 hit by new outage causing connectivity issues (source)
- Augmenting Your Microsoft 365 EOP and MDO Email Security Infrastructure (source)