New phishing campaign successfully bypasses Microsoft ATP (Office ATP, Defender ATP, and Azure ATP). It also bypasses SmartScreen. Works by sending an .HTM attachment or .ZIP containing .HTM.
IOCs
instantrep.xyz
secured.com.awi-o.online
json.geoiplookup.io
IOCs
instantrep.xyz
secured.com.awi-o.online
json.geoiplookup.io
The reason this attack is so effective at reaching inbox:
1. Originates from a compromised mailbox, so it passes SPF, DMARC and DKIM.
2. The .HTM is not malicious, so sandbox detonation is not a problem.
3. There is no remote URL attempted unless the user clicks their username.
1. Originates from a compromised mailbox, so it passes SPF, DMARC and DKIM.
2. The .HTM is not malicious, so sandbox detonation is not a problem.
3. There is no remote URL attempted unless the user clicks their username.
I've received the same payload from two different compromised accounts at different companies. The body of the email is the same:
"Remittance advice required."
Firstname Lastname (of compromised user)
CFO
"Remittance advice required."
Firstname Lastname (of compromised user)
CFO
Enable MFA.
Consider blocking .HTM attachments.
Consider blocking .HTM attachments.
