How Cybercriminals Exploit Link-Wrapping Services to Hack Microsoft 365 Accounts

Cybercriminals have developed a sophisticated method to compromise Microsoft 365 accounts by exploiting link-wrapping services, notably those provided by Proofpoint and Intermedia. This technique involves manipulating the very tools designed to protect users, thereby increasing the effectiveness of phishing campaigns.

Understanding Link-Wrapping Services​

Link-wrapping services are security mechanisms that rewrite URLs in incoming emails to route them through inspection gateways. This process allows for real-time evaluation of links, blocking access to malicious destinations. Proofpoint's URL Defense, for instance, prefixes links with "urldefense.proofpoint.com," signaling to users that the link has been vetted. Similarly, Intermedia offers a comparable service to safeguard email communications.

The Exploitation Process​

Attackers initiate their scheme by creating phishing emails that mimic legitimate communications, such as voicemail notifications or shared Microsoft Teams documents. These emails contain links leading to counterfeit Microsoft 365 login pages designed to harvest user credentials.
To enhance the credibility of these malicious links, cybercriminals employ a multi-step obfuscation strategy:

• URL Shortening: The attackers first shorten the URL of the phishing page using popular URL shortening services.
• Compromised Accounts: They then gain access to email accounts protected by link-wrapping services, such as those from Proofpoint or Intermedia.
• Link Wrapping: Using these compromised accounts, the attackers send emails containing the shortened URLs. The link-wrapping service automatically rewrites these URLs, giving them a trusted appearance.

This method effectively launders the malicious links through reputable domains, making them appear legitimate and thereby increasing the likelihood that recipients will click on them.

Real-World Implications​

Cloudflare's Email Security team has observed multiple instances of this attack vector. In one campaign, attackers sent emails with subjects like "New voicemail" or "Secure document for retrieval," enticing users to click on links that led to fake Microsoft 365 login pages. These pages were meticulously crafted to resemble authentic login portals, making it challenging for users to discern the deception.
The exploitation of link-wrapping services underscores a significant vulnerability in email security protocols. By manipulating these protective measures, attackers can bypass traditional security filters and directly target users.

Mitigation Strategies​

To defend against such sophisticated phishing attacks, organizations and individuals should consider implementing the following measures:

• Enhanced Email Filtering: Utilize advanced email filtering solutions that can detect and block emails with suspicious link patterns, even when they appear to originate from trusted sources.
• Multi-Factor Authentication (MFA): Enforce the use of MFA across all accounts to add an additional layer of security, making it more difficult for attackers to gain access even if credentials are compromised.
• User Education: Conduct regular training sessions to educate users about the latest phishing tactics, emphasizing the importance of scrutinizing email links and verifying the authenticity of unexpected communications.
• Regular Security Audits: Perform periodic security assessments to identify and address potential vulnerabilities within the organization's email infrastructure.
• Monitoring and Response: Establish robust monitoring systems to detect unusual account activities and have an incident response plan in place to address potential breaches promptly.

Conclusion​

The abuse of link-wrapping services by cybercriminals to steal Microsoft 365 credentials highlights the evolving nature of phishing attacks. By understanding the mechanisms of these exploits and implementing comprehensive security measures, organizations can better protect themselves and their users from such sophisticated threats.

---

Source: TechRadar Hackers are stealing Microsoft 365 accounts by abusing link-wrapping services