Avoid This Common Office 365 Scam

Major scam alert to all Office 365 users: 

Phishing campaigns are using fake voicemails and phony emails "from" Microsoft to target unassuming companies and breach their network systems.

There are several things you and your organization should do to protect yourself against this scam, which according to McAfee researchers has targeted companies at all personnel levels and has impacted a range of industries including:

• IT
• Retail
• Insurance
• Finance
• Infrastructure
• Energy
• Legal
• Government
• Healthcare
• Education
• Transportation

Among these important self-protection steps are: educating all users about this scam and (first and foremost) utilizing best-practice techniques to avoid security breaches. 

Have you provided annual security awareness training for your team? They're your best defense against cybersecurity breaches.

What Is The Office 365 Scam?

Here's a basic rundown of how this Office 365 scam works: 

First, pop-up warnings or spurious emails (usually containing Microsoft's logo, a link, and/or a HTML attachment) show up, telling the recipient that their computer has been infected or that they've missed a call from such-and-such person or phone number. Information such as caller ID, date, call duration, and references numbers may be included in the email. 

Whatever the specific message actually is, the overall intent of this email is to get the recipient to contact the scammers (by engaging with links and following any instructions provided) and give them login information related to their Office 365 account. By providing scammers with their credentials, the attackers can gain access to the recipient's email contact lists and other sensitive data that the recipient normally has access to, including cloud storage data.

The team of McAfee researchers studying and reporting on the Office 365 scam has determined that attackers are using phishing kits purchased on the underground market in order to carryout this scam. One phishing kit is even called Voicemail Scmpage 2019—subtle, right?

5 Warning Signs Of The Office 365 Scam

How can you fully protect yourself against a potential threat if you don't know how to recognize it? Here are a few major signs that may indicate the presence of the Office 365 scam:

1. You receive an email or see a warning on your PC stating that it's been infected or that Microsoft has been trying to reach you. The pop-up warning then instructs you to immediately call "Windows support," "tech support," or "help desk" at the phone number provided. This sham warning will rarely say “Microsoft Support" and may feature (as an email attachment) the format DD-Month-YYYY.wav.html, Voice-DD-MonthYYYYwav.htm or Audio_Telephone_MessageDD-Month-YYYY.wav.html.
2. The warning will be difficult to close. For instance, clicking on the close button (X) won't let you exit the pop-up, the warning may take up part of or the entire screen, or you have to force quit or end the task via the task manager.
3. After clicking on the link provided in the email or pop-up warning, the site you're redirected to is accompanied by a pre-recorded message. This provides a sense of urgency and may trick victims into thinking they are responding to a legitimate issue.
4. The pop-up warning populates while you are visiting a legitimate and known website.
5. Your pop-up blocker software doesn't block these alerts, and the fake warning shows up on all browsers, email accounts, and operating systems within your company.

Protecting Your Company Against the Office 365 Scam

As Office 365 scams pop up their ugly heads again, it's important that you take necessary steps to protect your company against them. To this end, here area few important steps to keep in mind:

• Any suspicious pop-up or email should be immediately reported. 
• If you encounter a suspicious pop-up, clear your browser history and run a virus scan. 
• Always use two-factor authentication for Office 365 accounts.
• Use appropriate email filters.
• Educate all users about the potential warning signs of any phishing activity. Ensure they understand never to click on suspicious links or download and open attachments from unknown users. In other words, communicate with your team that suspicious notices or emails should not be engaged with in any way! Also ensure your team members know what steps should be done if spurious activity is suspected. 

Boost your confidence, confidentiality, company, and customer experience with the help of our team at Integrity Technology Solutions. Contact us today to learn more about our services and find out how we can help you make sense of security in a rapidly evolving digital world. 

Photo by Johny vino on Unsplash