To hunt for corporate credentials cybercriminals now hide phishing links in a file on a hijacked SharePoint server and distribute them using a native notification mechanism. Such emails are better at bypassing spam filters and seem more convincing, especially if the company uses this service. Recently, Kaspersky experts observed more than 1,600 malicious notifications with potential victims in Europe, North America, and other regions. Although the scale of the attacks is not massive yet, companies should be aware of the new scheme and mitigate risks in advance.
Spam filters are almost always capable of detecting phishing emails with a link in the body of the letter, so cybercriminals are constantly refining their tools to try bypassing security solutions. Now, they don’t just hide phishing links on a SharePoint server, as in previously known schemes, but they distribute it using legitimate SharePoint notifications. A Kaspersky security solution filtered more than 1,600 malicious notifications between December 2022 and February 2023. Cybercriminals tried to lure data from companies in
Austria, France, India, Italy, Japan, the Netherlands, Russia, Singapore, South Korea, Spain, and the U.S.
This ploy with legitimate notifications lulls the vigilance of even tech-savvy employees. Notifications are sent on behalf of a real company’s services, and they do not raise doubts, especially if the company uses SharePoint as part of its everyday routine.
How phishing via SharePoint notifications works
An employee receives a standard SharePoint notification saying that someone has shared a OneNote file with them. This email is absolutely legitimate and can bypass the spam filter more easily than a phishing link hidden on a SharePoint server.
Legitimate SharePoint notification example
An employee follows the link, where the OneNote file mentioned opens, but the body of the note contains another ‘notification’ with a huge icon of a different type of file (for example, PDF) and a standard phishing link.
Malicious OneNote file on the SharePoint server with a
PDF icon
This phishing link leads to a phishing website that mimics the Microsoft OneDrive login page. Cybercriminals use it to steal the credentials for various email accounts, such as Yahoo!, AOL, Outlook, Office 365, and others.
A fraudulent website that mimics the Microsoft
OneDrive login page
How companies can mitigate risks against this type of phishing
Although such phishing letters are convincing, they can be distinguished by the array of red flags that can be explained to employees.
"To begin with, the file is unknown as well as the sender. Colleagues don’t normally share documents without an intro. There are more red flags: a link to the OneNote file in the notification and PDF-file appears on the server out of the blue. Furthermore, the download link leads to a third-party site, which web address has nothing to do with the victim's organization or SharePoint server. The phishing site mimics login page for OneDrive, which is another Microsoft service that is not related to SharePoint. To stay safe, it is necessary to use caution with all suspicious emails and watch out for such inconsistencies," explains Roman Dedenok, Spam Analysis Expert at Kaspersky.
Learn more about phishing with SharePoint notifications on Kaspersky blog. To stay protected from various phishing techniques targeting small, medium, and large businesses, Kaspersky recommends implementing the following measures:
- Use security solutions with anti-phishing technologies not only at the company's mail servers but also on all employees' work devices.
- Provide your staff with basic cybersecurity hygiene training. Conduct a simulated phishing attack to ensure that they know how to distinguish phishing emails
- If using Microsoft 365 cloud service, don’t forget to protect it too. Kaspersky Security for Microsoft Office 365 has a dedicated anti-spam and anti-phishing as well as protection for SharePoint, Teams, and OneDrive apps for secure business communications.
