A phishing campaign was recently discovered by ISC Handler Xavier Mertens and it seems as though the campaign is still  active.

The phishing emails look like legitimate Office 365 non-delivery notifications and include Office 365 branding. As is the case with official non-delivery alerts, the user is warned hat messages have not been delivered and told that action must be taken.

The Office 365 phishing emails claim that “Microsoft found Several Undelivered Messages” and attributes the non-delivery to “Server Congestion.” The emails direct the sender to retype the recipient’s email address and share the message again, although conveniently they have a Send Again button.

If users use the Send Again button, they will be directed to a website that closely looks like official Office 365 website and includes a login box that has been pre-filled-out with the user’s email address.

If the password is handed over, a JavaScript function sends both the email address and password to the hacker. The user will then be sent to the actual outlook.office365.com website where they will be shown a real Office 365 login box.

While the Office 365 phishing emails and the website look genuine, there are signs that all is not what it seems. The emails are well composed and the sender’s email – postmaster@us.ibm.com – looks official but there is irregular capitalization of the warning alert: Something that would not be included on an official Microsoft notification.

The most obvious sign that this is a phishing scam is the domain to which users are directed if they click on the Send Again button. It is not an authentic Microsoft domain (agilones.com).

While the mistake in the email may be missed, users should notice the domain, although some users may proceed and enter passwords as the login box is the exact same as the login on the official Microsoft site.

The campaign shows just how vital it is to carefully check every message before taking any action and to always review the domain before disclosing any sensitive data.

Hackers use Office 365 phishing emails because so many companies have signed up to use Office 365. Mass email campaigns therefore have a high probability of reaching an Outlook inbox. Even so, it is easy to target office 365 users. A business that is using Office 365 broadcasts it through their public DNS MX records.

Companies can bolster their resilience to phishing attacks through mandatory security awareness training for all staff. Employees should be told to always review messages carefully and should be taught how to spot phishing emails.

Companies should also make sure they have an advanced spam filtering solution implemented. While Microsoft does provide anti-phishing protection for Office 365 via its Advanced Threat Protection (APT) offering, businesses should think about using a third-party spam filtering solution with Office 365.

SpamTitan supplies protection against phishing and zero-day attacks, an area where APT experiences difficulty.