Proofpoint impersonator steal Microsoft, Google logins in phishing campaign

Clever hackers dodged Microsoft security by pretending to be a cyber security firm

Hackers impersonating cyber security company Proofpoint have launched a new phishing campaign targeting victims’ Microsoft and Google email credentials.

Researchers at Armorblox discovered emails claiming to contain a secure file sent via Proofpoint as a link. The problem was spotted at an unnamed global communications company with around 1,000 mailboxes at risk from the scam.

“Clicking the link took victims to a splash page that spoofed Proofpoint branding and contained login links for different email providers. The attack included dedicated login page spoofs for Microsoft and Google,” said researchers.

The email’s subject line was “RE: Payoff Request” and claimed to contain a mortgage-related file sent via Proofpoint along with an email footer exhorting the importance of confidentiality. Researchers said that adding “RE” to the email title is a tactic we have observed scammers using before — this signifies an ongoing conversation and might make victims click the email faster.

After clicking the pretend “secure” email link in the email, victims would then see a web page with the Proofpoint logo and spoofed login buttons for Google, Outlook, and Office 365.

“Clicking on the Google and Office 365 buttons led to dedicated spoofed login flows for Google and Microsoft, respectively. Both flows asked for the victim’s email address and password,” said researchers.

These pages were hosted the “greenleafproperties[.]co[.]uk” parent domain. The domain’s WhoIs record shows it was last updated in April 2021, according to researchers. They added the URL currently redirects to “cvgproperties[.]co[.]uk”. 

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastFree download

“The barebones website with questionable marketing increases the possibility that this is a dummy site,” researchers said.

According to researchers, phishing emails replicate existing workflows within organizations. “When we see emails, we’ve already seen before, our brains tend to employ System 1 thinking and take quick action,” they added.

The email managed to get past Microsoft email security, according to researchers. “This email had a Spam Confidence Level (SCL) score of 1, which means Microsoft determined the email was not spam,” said researchers.

Researchers recommended users subject any email to an eye test that includes inspecting the sender's name and email address, the language within the email, and any logical inconsistencies. They also recommended organizations deploy multi-factor authentication (MFA) on all business and personal accounts.

Featured Resources

2021 Thales cloud security study

The challenges of cloud data protection and access management in a hybrid and multi cloud world

Free download

IDC agility assessment

The competitive advantage in adaptability

Free Download

Digital transformation insights from CIOs for CIOs

Transformation pilotes, co-pilots, and engineers

Free download

What ITDMs did next - and what they should be doing now

Enable continued collaboration and communication for hybrid workers

Recommended

Trend Micro Worry-Free Business Security review: Great cloud-managed malware protection
endpoint security

Trend Micro Worry-Free Business Security review: Great cloud-managed malware protection

7 Dec 2021
BitMart suspends withdrawals following hack
cryptocurrencies

BitMart suspends withdrawals following hack

6 Dec 2021
Bridging the DevSecOps divide: Spotlight on key relationships
Whitepaper

Bridging the DevSecOps divide: Spotlight on key relationships

3 Dec 2021
Planned Parenthood cyber attack exposes data of 400,000 patients
cyber attacks

Planned Parenthood cyber attack exposes data of 400,000 patients

3 Dec 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021