SECURITY ALERT!
We knew it wouldn’t be long before hackers began to target Microsoft’s Office365 platform directly. We have been informed about a new email Phishing attack, called “PhishPoint” focused on users of the Office365 platform, specifically related to the use of OneDrive and SharePoint.
The scam will, and does, look very authentic to you and your users – so much so that many people are already falling victim.
What you need to know, and what to do:
- The attack is sent through as email directed to your users focused on getting them to fall victim to sharing their Office365 credentials.
- The email subjects will have something like the word URGENT in order to get the users attention.
- Inside that email is a link which takes the user to a legitimate SharePoint Online URL.
- Then it brings the user to what appears to be an Office365 login page
- If the user enters their credentials into the fake site, then they’ve been scammed.
What can you do about it?
- Alert all of your employees of this scam, so they don’t fall victim to what seems like a very legitimate email.
- Consider adding the following types of services to help protect yourself
- Information Security Awareness Training Platform. A trained and sufficiently paranoid workforce is your best defense.
- Office365 Security Logging that helps track, find, alert and provide forensics when these things happen.
- Office365 Cloud Backups. Microsoft doesn’t backup your data, and if your data is stolen and deleted there is no recovery from Microsoft.
- Microsoft Office365 Advanced Threat Platform, whereby Microsoft has advanced threat technology in place to help thwart these types of attempts.
For more information on this “PhishPoint” attack, click on this link!