Teams-Themed Phishing Campaign Abused Legitimate Microsoft Login Pages

A recent hacking campaign impersonated notifications from Microsoft Teams and abused Microsoft’s legitimate authentication infrastructure to compromise corporate Outlook, SharePoint and OneDrive accounts.

In a blog post published on July 29, cybersecurity researchers at Check Point warned that attackers are increasingly abandoning fake Microsoft login pages in favor of abusing Microsoft’s legitimate authentication infrastructure.

By employing this tactic, attackers hope that their phishing campaigns have a higher chance of being successful by avoiding some of the telltale signs of suspicious activity which users may be aware of.

The campaign started in the final weekend of June and continued into July, targeting users at 120 organizations including manufacturing, legal and healthcare, with emails designed to look like a notification alert for Microsoft Teams from the company’s HR department.

Disguised as Microsoft Planner task-assignment notification, the sender’s name on the email was “There’s New Activity On Teams” and claimed HR had sent messages to the user on Microsoft Teams. The body of the message also referenced “overdue tasks” in an attempt to employ social engineering to pressure the user into interacting with the fake request.

If the user clicked a link in the message, they were taken to legitimate OAuth authorize URL.

If the user attempted to sign-in, the page provided them with a prompt to accept to “Approve permissions” or “Accept on behalf of your organization.” If the user did this, the login attempt was redirected to attacker-controlled infrastructure, and the attacker also received an authorization token.

With all of this done via their infrastructure, the attackers had the ability to access the account and could exploit this to do anything a legitimate user could do with their Microsoft 365 suite.

“Attackers have stopped forging Microsoft’s front door and started walking through it. Every screen the victim sees is authentic, the only fake thing in this entire chain is the intent behind the app requesting access,” Check Point said in the blog post.

With this access to the email account secured, researchers detailed that as well reading messages and exfiltrating data from the victim’s inbox, attackers could use this access to a legitimate, trusted account as a springboard for Business Email Compromise (BEC) attacks.

While this specific campaign is no longer active, Check Point noted that it is “yet another example of how attackers have fundamentally changed how they’re bypassing traditional phishing defenses.”

To help identify and protect against campaigns which use these techniques, Check Point recommended implementing the following advice:

• Hover over links before clicking and check whether the destination matches the service referenced in the message. Be suspicious when different buttons lead to the same URL
• Verify that the sender name, sender address, and sending domain are consistent. In this campaign, the message appeared to come from the recipient’s own email address, while the display name claimed to represent Teams activity
• Do not trust an email simply because it appears to come from an internal address. Display names and sender addresses can be spoofed or manipulated
• When uncertain, open Teams or other applications directly through the official app rather than using links in the email