This content is viewable by Everyone
Mar 2023: Attacks Spread Microsoft Teams-Themed Lures
Threat Alert: What to Watch For
- Cybercriminals have launched phishing attacks using lures that impersonate Microsoft Teams meeting invites. The lures include a malicious link.
- Clicking the malicious link leads to a credential phishing kit that redirects the user to a legitimate login page. While the page itself is legitimate, the original phishing server will intercept any entered credentials, including multi-factor authentication (MFA) tokens.
- The email lures use the recipient’s email as the spoofed sending address to increase the legitimacy of the lure.
Key Action: Report Suspicious Emails
- Report ANY suspicious emails using the Phish Alarm button in your email menu bar.
- Remember: Our organization occasionally sends phishing simulations that are used to evaluate the potential impact of a real phishing attack. Report any emails that match the tactics described above.
- If a reported message is a simulation, you will see a notification alerting you to that. No further action is needed on your part.
- If a reported message was not a simulation, and you are concerned about a time-sensitive request, you must take additional steps to verify the email is valid before acting on it.
Tips to Remember (at Work and at Home)
- Go beyond surface clues. Familiar logos, branding, and names are not automatic indicators that an email or website is safe. Cybercriminals often imitate well-known organizations.
- Verify the legitimacy of any unsolicited/unexpected email before you interact with it, especially if it directs you to click on a link or asks you to provide credentials. It can be tempting to click on a “call-to-action,” especially for accepting routine meeting invitations. But if you notice a subtle change or inconsistency within a message, don’t ignore it—report it.
- Remain alert to phishing indicators. Sending address inconsistencies, such as receiving an email ostensibly from yourself for a meeting you did not create, should always be taken as a phishing warning sign.