Office 365 phishing abuses Oracle and Amazon cloud services

A rather complex phishing scheme for stealing Office 365 credentials from small and medium-sized businesses in the U.S. and Australia combines cloud services from Oracle and Amazon into its infrastructure.

The campaign has been active for more than half a year and uses a network of legitimate websites that have been compromised to work as a proxy chain.

The operators bait recipients with fake notifications for voice messages and Zoom invitations that ultimately lead the victim to the phishing page collecting login credentials.

Cybersecurity company Mitiga says that despite the simple lure and purpose, the campaign stands out as sophisticated as the road to exfiltration goes through legitimate services and websites.

According to their research, the threat actor sends phishing messages from compromised email accounts and uses Amazon Web Services (AWS) and Oracle Cloud in the redirect chain.

“Once the link was clicked, the user is redirected through several proxies, including AWS load balancers, all the way to a legitimate but compromised website” – Ofir Rozmann, threat intelligence at Mitiga

Redirect flow

Next, victims are redirected to a hacked website that takes them to the fake Office 365 page hosted mostly on Oracle Cloud computing service.https://googleads.g.doubleclick.net/pagead/ads?guci=2.2.0.0.2.2.0.0&client=ca-pub-3622156405313063&output=html&h=280&slotname=7f03b9d.cbb0e9b&adk=2136080057&adf=3878695576&pi=t.ma~as.7f03b9d.cbb0e9b&w=336&lmt=1606502588&psa=1&format=336×280&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Foffice-365-phishing-abuses-oracle-and-amazon-cloud-services%2F%3F%26web_view%3Dtrue&flash=0&wgl=1&adsid=ChEIgM2S_gUQzN_42M_QwuOnARJMAL1WgU1FOZU1Naemx8sNwRC8mQN6Of–M1e48fgPj646PSm8a3JJWVogo9urndWFDAms0kDOnZdaHaDMuvAb3f9AzshRFnl1mNWhaQ&uach=WyJXaW5kb3dzIiwiMTAuMCIsIng4NiIsIiIsIjg2LjAuNDI0MC4xOTgiLFtdXQ..&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1606753151701&bpp=8&bdt=80911&idt=10&shv=r20201112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D2cf5435d293f309b%3AT%3D1606753076%3AS%3DALNI_MaoVo8-sU7zVnWQIOR4JqfnCLOKiA&prev_fmts=0x0%2C1349x568&nras=2&correlator=5103378624177&frm=20&pv=2&ga_vid=1698274668.1606030711&ga_sid=1606753074&ga_hid=49251353&ga_fc=0&iag=0&icsg=178129473765376&dssz=65&mdo=0&mso=0&u_tz=330&u_his=1&u_java=0&u_h=768&u_w=1366&u_ah=728&u_aw=1366&u_cd=24&u_nplug=3&u_nmime=4&adx=90&ady=2364&biw=1349&bih=568&scr_x=0&scr_y=2062&oid=3&pvsid=2233225835021239&pem=736&ref=https%3A%2F%2Fcyware.com%2F&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1366%2C0%2C1366%2C728%2C1366%2C568&vis=1&rsz=%7C%7CpoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=12&uci=a!c&fsb=1&xpc=aGSzQlrWJx&p=https%3A//www.bleepingcomputer.com&dtd=44

In some cases, the actor used Amazon Simple Storage Service (Amazon S3). The credentials entered on this page are automatically delivered to another hacked website.

Mitiga says that they identified more than 40 compromised websites that were part of this Office 365 phishing campaign.

Clues point to phishing as a service

Clues found in the HTML code for the fake Office 365 pages suggest that the infrastructure is part of a phishing-as-a-service business rented to multiple clients.

Evidence of this are commented instructions like “//Set Link Here” and small differences in variables, function names, or compromised sites that received the stolen credentials, which could indicate that multiple parties use the same infrastructure.

The researchers also found references to some regions in Asia such as Gagal (Iran), Kurang (India), and Kosong (North Korea), as well as Indonesian words (“tombol” – button, “tekan” – press, “kolom” – column, “kirim” – send).

These could hint at the operators of the phishing-as-a-service business or their customers. However, these may also be false flags introduced to mislead researchers.

From the email addresses analyzed, Mitiga determined that the targets of this phishing operation are predominantly C-level executives at small and medium-sized businesses as well as major financial institutions.

Mitiga makes the following recommendations to avoid falling victim to these attacks:

• Enable two-factor authentication (2FA) for Office 365 login
• Enforce Office 365 password updates
• Examine forwarding rules in email accounts
• Search for hidden folders in email inboxes and messages in a different location than normal
• Log changes to mailbox login and settings and keep the data for at least 90 days
• Enable alerts for suspicious activity, such as unusual logins, and analyze server logs for abnormal email access. 
• Consider simulating a similar attack scenario using a red team to test the phishing awareness of the organization

Source: https://www.bleepingcomputer.com/news/security/office-365-phishing-abuses-oracle-and-amazon-cloud-services/?&web_view=true