Check Point Research has identified a new phishing campaign that exploits Microsoft’s Dynamics 365 Customer Voice, a customer relationship management software product. It’s often used to record customer calls, monitor customer reviews, share surveys, and track feedback.
Microsoft 365 is used by over 2-million organisations worldwide. At least 500 000 organisations use Dynamics 365 Customer Voice, including 97% of Fortune 500 companies.
In this campaign, cybercriminals send business files and invoices from compromised accounts and include fake Dynamics 365 Customer Voice links. The email configuration looks legitimate and easily tricks email recipients into taking the bait.
As part of this campaign, cybercriminals have deployed over 3 370 emails, with content reaching employees of over 350 organisations, the majority of which are American. More than 1-million different mailboxes were targeted.
Affected entities include well-established community betterment groups, colleges and universities, news outlets, a prominent health information group, and organisations that promote arts and culture, among others.
Campaign execution details
The phishing emails centre around financially focused themes. Subject lines typically discuss settlement statements, ALTA, EFT payment info, or closing disclosures.
As mentioned previously, the emails themselves include phony links. The links claim that the recipients have received a new voicemail or PDF document. All messages are intended to appear legitimate.
When recipients click on the illegitimate links, they are directed to a Captcha test which is intended to convince targets that they are not interacting with a phishing email and that instead, they are interacting with an authentic request.
Afterwards, the recipient is directed to a phishing site, which mimics a Microsoft login page. This is where the attackers attempt to steal users’ information.
Impact
The primary objective of this phishing campaign is to steal user credentials. In the event that cybercriminals are successful, they can gain unauthorised access to sensitive information and systems.
As a result, organisations could see the manipulation of internal accounts, the theft of funds, and/or operational disruptions.
Mitigations
Microsoft has blocked some of these phishing pages. However, some attempts may have reached inboxes before pages were taken down.
Cybersecurity leaders should inform employees about the potential for suspicious emails and the importance of confirming their origination points, especially those that claim to be from Microsoft services – including Dynamics 365 Customer Voice.
It goes without saying that businesses should ensure that they have the most advanced email security possible. Think AI-powered, cloud-delivered and multi-layered with inline, integrated threat protection mechanisms.
Check Point has successfully blocked emails from this campaign by extracting the links, and security layers have been added to products to prevent and detect future related threats.