As technology advances, criminals who hide behind computer screens are getting increasingly creative with their methods with every passing day. Hackers have now found a way to target Office 365 and Netflix users and gain access to their accounts via fraudulent emails.
Fraudulent Netflix emails
Netflix subscribers have started receiving emails from a compromised email account with "Your Netflix Membership is on hold" as the subject, according to MailGuard. The fake email includes a verification link, which when clicked on, redirects the user to a fake Netflix "Sign In" page where the subscriber's username and password are entered.
These user credentials are then harvested, presumably to be sold on the dark web. The fraudulent emails also come with a warning stating that a failure to complete the process will result in their Netflix membership being suspended.
In addition to this, the scam also takes users to a fake "Your Billing Information" page, asking for the users' social security number and date of birth. The page also includes the "Secure Server" icons to make it look authentic.
Malicious Office 365 app
Cybercriminals have also started using a malicious Microsoft 365 app to harvest user credentials. According to security experts at PhishLabs, hackers first send out a phishing email impersonating an internal SharePoint and OneDrive file-share in a bid to lure the victim into clicking an embedded link.
The link then takes the user to a legitimate Office 365 login page, if they're not already logged in. Once they have signed in, they are prompted to accept a request for permission for an app called "0365 Access." The list of permissions is broad, but should you choose to approve access to this app, you will effectively grant full control of your Office 365 account to the attacker, including the inbox, contact and OneDrive files.
How to avoid falling for these scams?
As far as the Netflix emails are concerned, MailGuard advises users to delete the email immediately without clicking on any links. "If you see an email from Netflix, please exercise caution and make sure it is a legitimate communication before you open it," the cybersecurity provider said in its blog post.
Meanwhile, PhishLabs pointed out that the Office 365 scam can be avoided by checking the sender account of the emails before clicking on any link or granting apps access. The security research company also recommended businesses to restrict the ability of Office 365 users to install Apps that are not downloaded from the official Office Store or otherwise approved.
You also need to examine other aspects of an email for red flags and avoid clicking links in emails that:
Although one can hardly make out if an email he has just received is a phishing email, there are other precautionary measures that one can have in place, such as the use of strong antivirus and anti-phishing tools, and other email protection tools which are available from leading internet security providers.
