Phishing attacks targeting Microsoft users are leveraging a fake Google reCAPTCHA page. Attackers are sending thousands of emails to steal Office 365 account credentials.
Combined with the forged reCAPTCHA ruse, top-level domain landing pages that include the victim’s company logo were discovered. Researchers say that at least 2,500 emails have been flagged after being sent to executives in the banking and IT sectors.
A link within the emails pointed the victims to a fake Google reCAPTCHA page. Once the targeted user passes the test, they are then redirected to a phishing landing page which prompts them for their Office 365 credentials.
The impact:
If a victim were to input their password and press submit, attackers would obtain their credentials and gain unauthorised access to the victim’s Office 365 environment (which would include their email correspondence).
The remediation:
It is important to raise awareness for social engineering attacks within your organisation to train staff to recognise phishing emails, calls, etc. This reduces the likelihood of a social engineering campaign being successful.
Source: Threat Post