Wednesday , February 19 2025

Microsoft Warns of AitM Phishing Attacks Against Financial Organizations

A newly discovered multi-stage Adversary-in-the-Middle (AitM) phishing and BEC attack campaign has been targeting banking and financial organizations. According to Microsoft, the attack originated from a compromised trusted vendor and transitioned to a series of AitM and BEC attacks. During this period, the attackers abused the trusted relationship between vendors, suppliers, and other partner organizations to launch financial fraud.

To launch the attack, the attackers used an AiTM phishing kit developed by a threat group called Storm-1167.

150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

Indian government and educational websites, along with reputable financial brands, have experienced SEO poisoning, causing user traffic to be redirected...
Read More
150 Gov.t Portal affected  Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has found 600 vulnerable PRTG instances in Bangladesh, affected by the...
Read More
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru

Amazon Web Services (AWS) has been named in an FIR after a builder claimed damages to the tune of Rs...
Read More
Builder claims Rs 150 cr for data loss;  AWS faces FIR In Bengaluru

CISA Warns Active Exploitation of Apple iOS Security Flaw

CISA has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, known as CVE-2025-24200, which...
Read More
CISA Warns Active Exploitation of Apple iOS Security Flaw

Massive IoT Data Breach Exposes 2.7 Billion Records

A major IoT data breach has exposed 2.7 billion records, including Wi-Fi network names, passwords, IP addresses, and device IDs....
Read More
Massive IoT Data Breach Exposes 2.7 Billion Records

SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

A serious authentication bypass vulnerability in SonicWall firewalls, called CVE-2024-53704, is currently being exploited, according to cybersecurity firms. The increase...
Read More
SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). If exploited, these could let...
Read More
AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

Lazarus Group Unleashes New Malware Against Developers Worldwide

Lazarus Group has initiated a complex global campaign aimed at software developers and cryptocurrency users. Operation Marstech Mayhem uses the...
Read More
Lazarus Group Unleashes New Malware Against Developers Worldwide

Daily Security Update Dated : 15.02.2025

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated : 15.02.2025

Salt Typhoon to target Bangladeshi Universities, One identified

RedMike (Salt Typhoon) targeted university devices in Bangladesh, likely to access research in telecommunications, engineering, and technology, especially from institutions...
Read More
Salt Typhoon to target Bangladeshi Universities, One identified

ALSO READ:

Indian CoWIN health database leaked: How safe “Surokkha” in Bangladesh

  • The attack began with a phishing email from a trusted vendor, which contained a unique seven-digit code as the subject.
  • The email body included a link to view or download a fax document, leading to a malicious URL hosted on Canva.
  • Once the victim clicked on the URL, they were redirected to a phishing page that spoofed a Microsoft sign-in page hosted on the Tencent cloud platform.
  • After the victim provided their passwords, the attackers initiated an authentication session with the victims’ credentials.

Key highlight:

  • The phishing kit enabled the attackers to send out more than 16,000 emails to a target’s contacts as part of the second-stage phishing campaign.
  • Furthermore, a new SMS-based 2FA method is added to the target account, to sign in using the pilfered credentials sans attracting any attention.

What more?

The development comes less than a month after Microsoft warned of a surge in BEC attacks and the evolving tactics employed by cybercriminals.

  • In one such attack, the scammers were found purchasing IP addresses from residential IP services.
  • This provided them with an opportunity to access the victim’s account and gather other credentials.
  • In another attack, scammers deployed phishing-as-a-service platforms, such as BulletProftLink, to host phishing and BEC sites.

Recommendations:

To remediate the issue, it is recommended to reset the passwords for compromised users. Additionally, enterprises should implement strong authentication measures and configure their mail systems to flag messages from non-trustworthy sources. Employees should also receive training to recognize fraudulent and malicious emails to prevent successful BEC attacks.

Source: Cyware

Check Also

SMM

AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). …

Leave a Reply

Your email address will not be published. Required fields are marked *