Organisations using Office365 are being targeted with an ingenious credential stealing campaign which uses Azure hosting to add legitimacy.

First reported by Edgewave, this approach uses fake Office365 login pages which are hosted on Azure.  By using Azure Blob Storage to host the html pages, the URL for the malicious webpage is delivered from the windows.net domain under a valid SSL certificate. This is because every URL on Azure Blob Storage uses the same wildcard SSL certificate issued to Microsoft (*.blob.core.windows.net)  The reasonable assumption by the criminals is that most business users would see the SSL icon and the windows.net domain in the URL and assume the webpage was a legitimate part of Office365.

Cybercriminals are using (spear)phishing emails to prompt users to visit the fake login pages.

With the corporate inbox emerging as one of the key corporate cyber-security battlegrounds for 2019, Security Managers have their work cut out to filter out the malicious emails and educate their users on how to identify the ones that do slip through the network’s perimeter defences.

How to protect your users from fake Office365 login pages

There are several steps that Security Managers can take to protect their networks from this attack vector:

Education – ensure your users understand that Office365 login pages will only ever be presented from one of:  Microsoft.com, live.com or Outlook.com.

Create a custom Office365 block rule in the Exchange Admin centre.

The custom mail flow rules provide a relatively easy way to create useful mail alerts for situations such as the email originating from outside the company domain (useful for combating CEO fraud emails) or the email contains the URL used by the Azure blob hosting service.

To create an alert for Azure Blog hosted webpages follow these steps:

1. Navigate to Office365 Exchange Admin Centre
2. Select Mail Flow -> Rules
3. Click ‘+’ to create a new rule
4. Select Apply this rule if… Subject or Body includes
5. Add the filter text: core.windows.net
6. Select your choice in ‘Do the following’ – either forward the email to your security team, reject it or prepend a warning to the body text