Phishers are launching campaigns that leverage fake Office 365 alerts to compromise administrator accounts.

In a campaign spotted by Bleeping Computer, fraudsters sent out fake admin alerts informing recipients that their organization’s Office 365 licenses had expired. The messages instructed recipients to click on a link so they could sign in to the Office 365 Admin Center and review their organization’s payment details. In reality, the link directed recipients to a phishing page designed to steal their administrator credentials.

Security researcher Michael Gillespie shared a similar attack with Bleeping Computer. In this campaign, fraudsters masqueraded as Office 365 representatives and used this disguise to inform recipients that someone had gained access to their admin accounts. The attack email prompted recipients to click on an “Investigate” button that, in turn, redirected them to a fake windows.net domain hosted on Azure. This tactic added greater legitimacy to the attack, as phishing pages hosted on Azure are secured using a Microsoft certificate.

A History of Fake Office 365 Alerts

This isn’t the first time cybercriminals have targeted Office 365. In May 2019, Bleeping Computer detected a phishing campaign that purported to come from the Office 365 team and warned recipients that their email account was slated for cancellation in an effort to steal their credentials. News of this attack came just two months before the computer security website spotted a fake Office 365 site that distributed the TrickBot infostealer disguised as Chrome and Firefox browser updates.

Given these attacks, it’s no wonder that 40 percent of organizations told Cyren and Osterman Research that digital attackers had succeeded in compromising enterprise Office 365 login credentials last year.

How to Defend Against Office 365-Based Attacks

Organizations can strengthen their defenses against attacks that leverage fake Office 365 alerts by conducting test phishing engagements to evaluate employees’ awareness of, and resilience against, social engineering attacks.

Security teams should also look to obtain phishing data that incorporates machine-deliverable threat intelligence, as this information provides indicators and impact ratings on which security professionals can act based upon their relevant risk.