Phishing Email Uses Google Ad Redirect to Steal Microsoft Credentials
Security researchers came across a phishing email that used a Google Ad redirect as a part of its efforts to steal victims’ Microsoft credentials.
Cofense found that the email originated from the legitimate email address “[email protected][.]co[.]za.” The security firm reasoned that attackers had compromised that email account and abused their access to target employees in multiple organizations.
The email arrived with a message indicating that it was sent with “High importance.” When coupled with the inclusion of the word “security” in the sender’s email address and the use of “Recent Policy Changes” as the subject line, this tactic attempted to trick the recipient into believing that the email was important and required immediate attention.
The researchers at Cofense found that both buttons contained the same embedded link. As they explained in their research:
…[T]he threat actor has utilized a Google Ad Services redirect to pilot users to their phish. This suggests that the threat actor(s) may have paid to have the URL go through an authorized source. In turn, this easily bypasses secure email gateways and exposes employees to the phish.
Doing so sent the user to another page designed to steal their (Read more...)
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by David Bisson. Read the original post at: https://www.tripwire.com/state-of-security/security-data-protection/phishing-email-uses-google-ad-redirect-to-steal-microsoft-credentials/