Kaspersky experts today share they have observed more than 1,600 malicious SharePoint notifications disguised as phishing links in a file on a hijacked SharePoint server. The malicious notifications are being distributed using a native notification mechanism. Such emails are bypassing spam filters as they are deemed legitimate, and there are potential victims in Europe, North America, and other regions. Although this attack has not yet reached a large number of users, organizations should be aware of the new scheme to mitigate future risk.
Since spam filters are almost always capable of detecting phishing emails with a link in the body of the letter, cybercriminals are constantly refining their tools to try bypassing security solutions. Cybercriminals have evolved their skills from hiding phishing links on a SharePoint server, as in previously known schemes, to now distributing them via legitimate SharePoint notifications. A Kaspersky security solution filtered more than 1,600 malicious notifications between December 2022 and February 2023. Cybercriminals tried to lure data from companies in Austria, France, India, Italy, Japan, the Netherlands, Russia, Singapore, South Korea, Spain, and the U.S.
How phishing via SharePoint notifications works
An employee receives a standard SharePoint notification saying that someone has shared a OneNote file with them. This email is absolutely legitimate and can bypass the spam filter more easily than a phishing link hidden on a SharePoint server.
An employee follows the link, where the OneNote file mentioned opens, but the body of the note contains another ‘notification’ with a huge icon of a different type of file (for example, PDF) and a standard phishing link.
This phishing link leads to a phishing website that mimics the Microsoft OneDrive login page. Cybercriminals use it to steal credentials for various email accounts, such as Yahoo!, AOL, Outlook, Office 365, and others.
How companies can mitigate risks against this type of phishing
Although such phishing letters are convincing, they can be distinguished by the array of red flags that can be explained to employees.
“To begin, the file is unknown as well as the sender. This is the first red flag as colleagues don’t normally share documents without an intro,” explains Roman Dedenok, spam analysis expert at Kaspersky.
“Additional red flags include a link to the OneNote file in the notification and PDF-file appears on the server out of the blue. Furthermore, the download link leads to a third-party site, which web address has nothing to do with the victim’s organization or SharePoint server. The phishing site mimics login page for OneDrive, which is another Microsoft service that is not related to SharePoint. To stay safe, it is necessary to use caution with all suspicious emails and watch out for such inconsistencies.”
