Attackers use EvilProxy phishing package to take over executives’ Microsoft 365 accounts

Risk actors have been utilizing the phishing toolkit EvilProxy to take management of cloud-based Microsoft 365 accounts belonging to executives at outstanding firms, researchers have discovered.

The cybersecurity agency Proofpoint, which launched a report on the incidents Wednesday, mentioned the assaults exhibited each the prevalence of pre-packaged phishing-as-a-service toolkits, in addition to the elevated bypassing of multi-factor authentication to realize entry to accounts.

In all, Proofpoint noticed the focusing on of greater than 100 organizations with EvilProxy, with 35% of the compromised accounts being MFA-enabled. Multiple-third of the accounts belonged to C-level executives, together with CEOs and chief monetary officers.

“As our analysis reveals, menace actors typically goal particular job capabilities or departments, and their strategies and strategies should continually evolve, equivalent to discovering methods to bypass multi-factor authentication,” Proofpoint mentioned. “Opposite to in style perception, not even MFA is a silver bullet towards refined cloud-based threats.”

Roles of people compromised within the assaults. Picture: Proofpoint

The EvilProxy package makes use of what is called an adversary-in-the-middle method, wherein communications between a tool and web sites are intercepted by a nasty actor. Between March and June 2023, Proofpoint noticed 120,000 phishing emails despatched out, normally impersonating manufacturers like Adobe and DocuSign.

When a recipient clicks on the malicious emails, after a collection of redirects they’re taken to a phishing web page that reverse proxies the login web page for Microsoft 365. When a sufferer enters their credentials, the instrument steals authentication cookies, permitting the hackers to bypass MFA.

As soon as they achieve entry, menace actors try to ascertain persistence on the account, in some circumstances establishing their very own MFA technique.

“Throughout these final phases, cyber criminals make use of numerous strategies, together with lateral motion and malware proliferation. The attackers have been identified to check their goal organizations’ tradition, hierarchy, and processes, to arrange their assaults and enhance success charges,” researchers wrote. “So as to monetize their entry, attackers have been seen executing monetary fraud, performing knowledge exfiltration or partaking in Hacking-as-a-Service (HaaS) transactions, promoting entry to compromised consumer accounts.”

The EvilProxy package was first detected in Might 2022, in line with the cybersecurity firm Resecurity, when its builders posted a video tutorial on its use. As of final fall, the package deal was accessible on the darkish internet for $400.