The researchers say they’ve observed the emails being sent from legitimate, compromised accounts as well as convincing spoofed domains. “At INKY, most of the Zoom impersonator phishing emails we have seen came from hijacked accounts, but we also saw newly created domain names like zoomcommuncations[.]com and zoomvideoconfrence[.]com,” they write.
“As disturbing as that is, it’s also what makes these fake meeting invitations so easy to fall for and so difficult for traditional Secure Email Gateways (SEGs) to catch.”
Additionally, the attackers are using obfuscation and other techniques that make it more difficult for security systems to detect their phishing pages. “If the hacker includes a fake attachment, it leads to a fake login page that’s locally hosted on the recipient’s computer, not the internet,” the researchers write.
INKY provides a number of screenshots of some of the spoofed websites, and they appear identical to the legitimate login portals for Outlook and Office 365. In the Outlook example, the site’s URL was “owa-mail-auth[.]web[.]app,” which could fool even someone who had been trained to scrutinize URLs.
Attackers are constantly taking steps to improve the reach and effectiveness of their phishing campaigns. New-school security awareness training enables your employees to avoid falling for these attacks, even if the phishing sites appear perfectly convincing.