Phishing via Legitimate Cloud Targets Microsoft Accounts

Cybercriminals are exploiting the reputation, free plans and features of legitimate cloud platforms to conduct phishing attacks, global cybersecurity company Kaspersky has warned.

The company’s research identified a phishing campaign in which more than 200,000 attacks used cloud platforms to steal Microsoft account credentials through a multi-stage deception process.

The campaign combines legitimate web services with fake CAPTCHA pages, dynamically generated web content and the Browser-in-the-Browser (BiTB) technique to make the attack harder to detect.

The attack begins by using the identity of a trusted or familiar person to persuade the victim to log in to a Microsoft account. In most cases, the victim receives a phishing link by email.

Clicking the link takes the user to a purported ‘anti-bot’ page, where the victim is asked to complete a fake CAPTCHA using a corporate email address.

Instead of verifying whether the user is human, the fake CAPTCHA collects the email address and redirects the user to a Cloudflare automatically assigned .workers.dev URL so the address can be passed to the next stage.

The victim is then taken to another page hosted on a free Cloudflare Workers subdomain, where a second CAPTCHA is displayed.

Although the second CAPTCHA is genuine, it is not directly embedded in the HTML code. Instead, it is dynamically added to the page, making the overall attack more difficult for security solutions to detect.

Fake Office 365 login window

The final stage presents the victim with a fake login window designed to resemble Office 365.

Created using the Browser-in-the-Browser (BiTB) technique, the window contains an address bar and window controls designed to look like those of a genuine browser.

However, it is actually a floating window rather than a real browser window.

When users enter their usernames, passwords and multi-factor authentication (MFA) codes, the information is transmitted to the attackers.

The malicious script also collects the victim’s session cookies. Once the information has been captured, the victim is redirected to a generic error page, making it less obvious that a phishing attack has taken place.

Legitimate cloud services become attack infrastructure

Kaspersky cybersecurity expert Olga Altukhova said, “Attackers actively exploit legitimate services due to their reputation, free plans, and tools that they can exploit. What’s more, in the example that we investigated in the report, phishers were able to create a multi-stage Adversary-in-the-Middle attack, proxying all traffic from what looked like a legitimate Microsoft website and combining it with Browser-in-the-Browser techniques. This shows how phishing techniques are becoming more and more sophisticated,” 

Her assessment indicates that identifying suspicious or obscure websites alone is no longer sufficient to detect phishing campaigns.

Because attackers can operate through legitimate and familiar cloud infrastructure, security teams increasingly need to examine webpage behaviour, scripts and dynamically generated elements alongside domain reputation and digital certificates.

Kaspersky’s five safety recommendations

Kaspersky has advised users to follow several precautions.

First, be cautious when dealing with CAPTCHA. CAPTCHA mechanisms generally do not request personal information such as an email address. If a verification process asks for personal information to prove that the user is not a robot, it should be treated as a potential warning sign of phishing or fraud.

Second, be cautious about unexpected login requests. A request should not automatically be considered safe simply because it comes from a trusted domain or uses a valid SSL certificate.

Third, check the URL in the actual browser address bar. In a Browser-in-the-Browser attack, criminals can imitate an address bar or popup inside a fake window. They cannot, however, change the domain displayed in the browser’s genuine address bar. Users should therefore verify the URL in the actual browser interface.

Fourth, keep browsers and security extensions updated. Outdated software and security components may have reduced capabilities against newer attack techniques.

Fifth, do not rely solely on domain reputation. Kaspersky recommends using reliable cybersecurity solutions capable of analysing webpage scripts and dynamic elements in addition to checking the reputation of the domain.

The campaign highlights how phishing operations are evolving beyond conventional fake websites. By combining legitimate cloud infrastructure, dynamic web technologies and convincing browser-interface replicas, attackers are attempting to build user trust while simultaneously making their campaigns harder for conventional security controls to identify.

//DBTech/RICP/SMP//