Email is often the first choice for a cybercriminal when they’re launching because it’s so easy to exploit. Unlike brute-force attacks which are heavy on processing power, or more sophisticated methods that require a high level of skill, domain spoofing can be as easy as writing an email pretending to be someone else. In a lot of cases, that ‘someone else’ is a major software service platform that people rely on to do their jobs.
In this recent series of incidents, users of Microsoft’s Office 365 service received what appeared to be routine update emails regarding the status of their user accounts. These emails came from their organizations’ own domains, requesting users to reset their passwords or click on links to view pending notifications.
We’ve compiled a list of some of the email titles we observed were being used:
- Microsoft account unusual sign-in activity
- You have (3) Messages Pending Delivery On Your e-Mail user@domain.com* Portal !
- user@domain You Have Pending Microsoft Office UNSYNC Messages
- Re-activation Summary Notification for user@domain.com
*account details changed for users’ privacy
You can also view a sample of a mail header used in a spoofed email sent to an insurance firm:
Our Security Operation Center traced the email links to phishing URLs that targeted Microsoft Office 365 users. The URLs redirected to compromised sites at different locations around the world.
By simply looking at those email titles, it would be impossible to tell they were sent by someone spoofing your organization’s domain. We’re accustomed to a steady stream of work or account-related emails prompting us to sign into various online services just like Office 365. Domain spoofing takes advantage of that, making their fake, malicious emails indistinguishable from genuine ones. There’s virtually no way to know, without a thorough analysis of the email, whether it’s coming from a trusted source. And with dozens of emails coming in everyday, no one has the time to carefully scrutinize every one. The only solution would be to employ an authentication mechanism that would check all emails sent from your domain, and block only those that were sent by someone who sent it without authorization.
That authentication mechanism is called DMARC. And as one of the leading providers of email security solutions in the world, we at PowerDMARC have made it our mission to get you to understand the importance of protecting your organization’s domain. Not just for yourself, but for everyone who trusts and depends on you to deliver safe, reliable emails in their inbox, every single time.
You can read about the risks of spoofing here: https://powerdmarc.com/stop-email-spoofing/
Find out how you can protect your domain from spoofing and boost your brand here: https://powerdmarc.com/what-is-dmarc/
- Can Blockchain Help Improve Email Security? - May 9, 2024
- Datacenter Proxies: Unveiling the Workhorse of the Proxy World - May 7, 2024
- Kimsuky Exploits DMARC “None” Policies in Recent Phishing Attacks - May 6, 2024