Beware Of New Voicemail Phishing Attack Targeting Office365 Login Credentials

By Editor Last updated Mrz 4, 2025

This article aims to provide an overview of a new phishing attack targeting Office365 login credentials. The campaign exhibits similarities to a prior attack and involves the use of Japanese email services to impersonate sender addresses. The emails are designed to appear as if they originate from the targeted organization and include an attachment that masquerades as a sound clip. However, the attachment contains obfuscated JavaScript code that redirects victims to a phishing site. The phishing site mimics a legitimate subdomain of the organization, utilizing a URL format based on the company’s domain. To evade suspicion, the attackers employ a CAPTCHA verification page before redirecting users to the phishing page where their Office365 credentials are harvested. Countermeasures against this attack include scrutinizing the login portal before entering credentials and exercising caution when prompted to log in again for voicemail. Additionally, staying updated on cybersecurity news and following official cybersecurity accounts on social media are recommended practices.

Quickjump

Key Takeaways

Threat actors are using Japanese email services to spoof sender addresses and make the emails appear to come from the targeted organization’s address.
The phishing site appears as a legitimate subdomain of the targeted organization and uses a URL format based on the company’s domain.
The phishing page steals Microsoft Office 365 credentials, and users should verify the login portal before entering their credentials.
Careless handling of emails increases the effectiveness of the scams, and users should be cautious of requests to log in again for voicemail and be aware that HTML attachments are commonly used in voicemail-themed scams.

Types of Attacks

One of the pre-existing knowledge points relates to the types of attacks used in the recent voicemail phishing campaign targeting Office365 login credentials. Differentiating phishing emails is crucial in understanding the nature of these attacks. In this campaign, threat actors employ various tactics to deceive users, such as using Japanese email services to spoof sender addresses and making emails appear to come from the targeted organization’s address. The emails contain an attachment that appears as a sound clip, but it actually contains obfuscated JavaScript code that hides a phishing site. This phishing site, disguised as a legitimate subdomain of the targeted organization, follows a specific URL format based on the company’s domain. Once the victim is directed to the site, they are prompted to pass a CAPTCHA verification page, which prevents suspicious activity detection. After passing the criteria, the user is redirected to the phishing page, where their Microsoft Office 365 credentials are stolen. These phishing attacks can have a significant impact on organizations, as careless handling of emails increases the effectiveness of such scams. It is crucial for users to verify the login portal before entering their credentials and to be cautious of requests to log in again for voicemail.

Redirection and CAPTCHA

Redirection and CAPTCHA are employed as part of the phishing campaign to direct victims to a fraudulent website while evading detection. The phishing site is designed to appear as a legitimate subdomain of the targeted organization, utilizing a URL format that follows an assembly method based on the company’s domain. Once directed to the phishing site, the victim is presented with a CAPTCHA verification page. This serves as a check to prevent suspicious activity detection and adds an extra layer of legitimacy to the attack. After passing the CAPTCHA criteria, the user is then redirected to the actual phishing page. This combination of redirection and CAPTCHA not only enhances the authenticity of the attack but also increases the effectiveness of the phishing campaign by reducing the likelihood of detection. Furthermore, the obfuscated JavaScript code used in the attachment plays a crucial role in hiding the phishing site, making it harder for victims to identify the scam.

Methods of Credential Theft

The phishing campaign employs various methods to steal user authentication data. The threat actors behind the attack target potential victims by sending emails that appear to come from the targeted organization’s address. They use Japanese email services to spoof sender addresses, adding to the deception. The phishing site itself is disguised as a legitimate subdomain of the targeted organization, following a URL format based on the company’s domain. To prevent suspicious activity detection, the victim is directed to a CAPTCHA verification page, which they must pass before being redirected to the phishing page. The phishing page is designed to steal Microsoft Office 365 credentials, taking advantage of careless handling of emails and the use of HTML attachments to disguise voicemail-themed scams. It is crucial for users to be cautious and verify the login portal before entering their credentials to avoid falling victim to these phishing techniques.

Threat actors use Japanese email services to spoof sender addresses
The phishing site appears as a legitimate subdomain of the targeted organization
CAPTCHA verification page is used to prevent suspicious activity detection

Domains Used by Threat Actors

Threat actors in the phishing campaign have utilized several domains to carry out their malicious activities. These domains include briccorp[.]com, bajafulfillrnent[.]com, bpirninerals[.]com, lovitafood-tw[.]com, dorrngroup[.]com, lacotechs[.]com, brenthavenhg[.]com, spasfetech[.]com, mordematx[.]com, and antarnex[.]com. The investigation of threat actor techniques reveals that they employ Japanese email services to spoof sender addresses, making the emails appear to come from the targeted organization’s address. The phishing sites used by the threat actors mimic legitimate subdomains of the targeted organizations, following an assembly method based on the company’s domain. These attacks have a significant impact on targeted organizations as they aim to steal Microsoft Office 365 credentials. It is crucial for users to verify the login portal before entering their credentials and be cautious of requests to log in again for voicemail. Understanding these threat actor techniques and the potential impact of phishing attacks is essential for organizations to enhance their cybersecurity measures.

Recommendations

To mitigate the risk of falling victim to phishing attacks, it is recommended that users verify the authenticity of the login portal before providing their credentials. This can be done by carefully examining the URL and ensuring it matches the official website. Additionally, organizations should educate their employees about the dangers of phishing attacks and provide regular training on how to identify and report suspicious emails.

Furthermore, implementing multi-factor authentication (MFA) can greatly enhance security and prevent credential theft. MFA adds an extra layer of protection by requiring users to provide additional verification, such as a code sent to their mobile device, in addition to their password. This significantly reduces the risk of unauthorized access even if the credentials are compromised. Organizations should strongly encourage the use of MFA for all employees, especially for accessing sensitive systems or data. By combining user education and MFA, organizations can significantly reduce the likelihood of successful phishing attacks and protect their Office365 login credentials.

Frequently Asked Questions

How can users differentiate between a legitimate voicemail login portal and a phishing page?

To differentiate between a legitimate voicemail login portal and a phishing page, users should be aware of common phishing techniques used in voicemail-themed scams. Additionally, implementing best practices for securing Office365 login credentials can help protect against phishing attacks.

Are there any specific signs or indicators in the email that can help identify a voicemail-themed scam?

Identifying red flags and recognizing common email phishing techniques can help users identify a voicemail-themed scam. Some indicators may include spoofed sender addresses, suspicious requests to log in again for voicemail, and the use of HTML attachments to disguise scams.

How can users verify the login portal before entering their Office365 credentials?

Users can verify the login portal before entering their Office365 credentials by implementing multi-factor authentication (MFA). This adds an extra layer of security by requiring users to provide additional verification, such as a code sent to their mobile device, in addition to their username and password. Additionally, users should be aware of common red flags in phishing emails, such as suspicious sender addresses, requests to log in again for voicemail, and HTML attachments disguised as voicemail-themed scams.

What steps can users take to ensure they are not falling victim to voicemail-themed phishing attacks?

To ensure they do not fall victim to voicemail-themed phishing attacks, users can take several steps. These include practicing secure password management, implementing two-factor authentication, and being cautious of suspicious requests to log in again for voicemail.

Are there any other precautionary measures users can take to protect themselves from this type of attack?

Precautionary measures to protect against voicemail-themed phishing attacks include: regularly updating and strengthening passwords, enabling multi-factor authentication, being cautious of suspicious emails or requests to log in again, and educating oneself on current phishing techniques. Security awareness is crucial in preventing such attacks.