Gillespie recorded the interaction with the scammer here. This is when the scammer gets to use their social engineering skills. When a potential victim fails to log into their Office365 account on the fraudulent website, they can turn to the customer support service, which is conveniently visible on the page.
CHAT WITH OFFICE 365 SUPPORT SOFTWARE
Probably in an effort to compensate for the lack of professionalism, the fraudsters integrated live chat support into the page using the legitimate chat software tawk.to to provide fake customer support service. The fraudulent website is still active and the scammers did such a poor job with it that it's difficult to believe anyone would fall for their ruse. Taking the bait and clicking on the link in the fake email lands you on the shoddy-looking website mso365tech that tries to pass as an official Microsoft resource. The name of the sender is MSOffice, but the email address is which could fool plenty of people into believing it is a legitimate notification from Microsoft. This particular Office 365 phishing fraud was discovered by security researcher Michael Gillespie and starts with an email impersonating a Microsoft alert for renewing the subscription for the Office suite of services. Security researcher Justin Miller, the author of the Phishing Kit Tracker, a collection of emails from 500 phishing kits, says that he's probably seen less than ten cases of phishing where chat was available.
However, its application in phishing fraud is rare.
It became popular with cybercriminal groups in the ransomware business that wanted to help their victims pay the ransom in bitcoin. Live chat support is nothing new in the world of fraud. Scammers handling a phishing website for Office 365 credentials added live support to add to the illusion of legitimacy necessary to trick victims.īut things don't always work the way the cybercriminals intend and their bluff was called by security researchers spotting the scam a mile away.
0 kommentar(er)
