Sunday , October 6 2024

Microsoft Teams exploiting tool on GitHub, What Microsoft say?

A new tool is available on GitHub that gives attackers a way to leverage a recently disclosed vulnerability in Microsoft Teams and automatically deliver malicious files to targeted Teams users in an organization.

The tool, dubbed “TeamsPhisher,” works in environments where an organization allows communications between its internal Teams users and external Teams users — or tenants. It allows attackers to deliver payloads directly into a victim’s inbox without relying on a traditional phishing or social engineering scams to get it there.

First Half Of 2024 Report
Bangladeshi 32.4% government websites face cyber attack: NAS report

National Attack Surface (NAS) report for the first half of 2024 reveals that 56.6% of cyberattacks in Bangladesh targeted educational...
Read More
First Half Of 2024 Report  Bangladeshi 32.4% government websites face cyber attack: NAS report

Prince Ransomware Hits UK and US

A new ransomware campaign is targeting individuals and organizations in the UK and US. The "Prince Ransomware" attack uses a...
Read More
Prince Ransomware Hits UK and US

CISA warns active exploit of Zimbra & Ivanti endpoint manager Vulns

CISA has issued an urgent alert about critical vulnerabilities being exploited in Synacor’s Zimbra Collaboration and Ivanti’s Endpoint Manager (EPM)....
Read More
CISA warns active exploit of Zimbra & Ivanti endpoint manager Vulns

A summary of “2024 State of Cybersecurity survey” by ISACA

ISACA 2024 survey report reveals that 66% of cybersecurity professionals find their jobs more stressful now than five years ago....
Read More
A summary of “2024 State of Cybersecurity survey” by ISACA

ISACA reveals
64% of Australian cybersecurity professionals feel increasing stress

A recent study by ISACA shows that almost two-thirds of cybersecurity professionals report increasing job stress. The 2024 State of...
Read More
ISACA reveals  64% of Australian cybersecurity professionals feel increasing stress

Researchers detected 31 new Malware in September

In September, cybersecurity experts discovered 31 new ransomware variants that threaten individuals and businesses. These programs encrypt valuable data, making...
Read More
Researchers detected 31 new Malware in September

CRI Release New Ransomware Response Guidance

New guidance on ransomware, released during this week's International Counter Ransomware Initiative (CRI) meeting, encourages victims to report attacks to...
Read More
CRI Release New Ransomware Response Guidance

ALERT
Over 700,000 Routers Vulnerable to Hack for 14 security flaws

Over 14 new security flaws have been found in DrayTek routers for homes and businesses, which could allow attackers to...
Read More
ALERT  Over 700,000 Routers Vulnerable to Hack for 14 security flaws

Patch it now!
Critical Zimbra RCE flaw exploited: Needs Immediate Patching

Hackers are exploiting a recently revealed RCE vulnerability in Zimbra email servers that can be activated by sending specially crafted...
Read More
Patch it now!  Critical Zimbra RCE flaw exploited: Needs Immediate Patching

CISA Warns
Network switch RCE flaw impacts critical infrastructure

CISA warns of two serious vulnerabilities in Optigo Networks ONS-S8 Aggregation Switches, which could allow authentication bypass and remote code...
Read More
CISA Warns  Network switch RCE flaw impacts critical infrastructure

“Give TeamsPhisher an attachment, a message, and a list of target Teams users,” said the tool’s developer Alex Reid, a member of the US Navy’s Red Team, in a description of the tool on GitHub. “It will upload the attachment to the sender’s Sharepoint and then iterate through the list of targets.”

ALSO READ:

Policy changed, Google now use your data for AI training

A member of the U.S. Navy’s red team has published the tool called TeamsPhisher that exploits a security issue in Microsoft Teams to bypass restrictions on incoming files from external tenants.

The tool works by tricking the client-side protections of Microsoft Teams into treating an external user as an internal one. This is possible because the application has a bug that allows the ID in the POST request of a message to be changed.

The tool was developed by Max Corbridge and Tom Ellson of UK-based security services company Jumpsec, who highlighted the problem last month. They explained that an attacker could use this bug to easily deliver malware to users in a targeted organization.

A Microsoft spokesperson has sent the following comment to media:

‘We’re aware of this report and have determined that it relies on social engineering to be successful. We encourage customers to practice good computing habits online, including exercising caution when clicking on links to web pages, opening unknown files, or accepting file transfers’.

According to GitHub, TeamsPhisher is a Python3 program that facilitates the delivery of phishing messages and attachments to Microsoft Teams users whose organizations allow external communications.

It is not ordinarily possible to send files to Teams users outside one’s organization. Max Corbridge (@CorbridgeMax) and Tom Ellson (@tde_sec) over at JUMPSEC recently disclosed a way to get around this restriction by manipulating Teams web requests in order to alter the recipient of a message with an attached file.

TeamsPhisher incorporates this technique in addition to some earlier ones disclosed by Andrea Santese (@Medu554). It also heavily leans upon TeamsEnum, a fantastic piece of work from Bastian Kanbach (@bka) of SSE, for the authentication part of the attack flow as well as some general helper functions.

Check Also

CISA

CISA reveals 2 Industrial Control Systems Advisories

On October 1, 2024, CISA released two advisories regarding Industrial Control Systems (ICS), highlighting current …

Leave a Reply

Your email address will not be published. Required fields are marked *