{"id":32238,"date":"2019-12-11T17:00:56","date_gmt":"2019-12-11T17:00:56","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=90286"},"modified":"2019-12-11T17:00:56","modified_gmt":"2019-12-11T17:00:56","slug":"the-quiet-evolution-of-phishing","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/the-quiet-evolution-of-phishing\/","title":{"rendered":"The quiet evolution of phishing"},"content":{"rendered":"

The battle against phishing is a silent one: every day, Office 365 Advanced Threat Protection<\/a> detects millions of distinct malicious URLs and email attachments. Every year, billions of phishing emails<\/a> don\u2019t ever reach mailboxes\u2014real-world attacks foiled in real-time. Heuristics, detonation, and machine learning, enriched by signals from Microsoft Threat Protection services, provide dynamic, robust protection against email threats.<\/p>\n

Phishers have been quietly retaliating, evolving their techniques to try and evade these protections. In 2019, we saw phishing attacks reach new levels of creativity and sophistication. Notably, these techniques involve the abuse of legitimate cloud services like those offered by Microsoft, Google, Amazon, and others. At Microsoft, we have aggressive processes to identify and take down nefarious uses of our services without affecting legitimate applications.<\/p>\n

In this blog we\u2019ll share three of the most notable attack techniques we spotted this year. We uncovered these attacks while studying Office 365 ATP signals, which we use to track and deeply understand attacker activity and build durable defenses against evolving and increasingly sophisticated email threats.<\/p>\n

Hijacked search results lead to phishing<\/h2>\n

Over the years, phishers have become better at evading detection by hiding malicious artifacts behind benign ones. This tactic manifests in, among many others, the use of URLs that point to legitimate but compromised websites or multiple harmless-looking redirectors that eventually lead to phishing.<\/p>\n

One clever phishing campaign we saw in 2019 used links to Google search results that were poisoned so that they pointed to an attacker-controlled page, which eventually redirected to a phishing page. A traffic generator ensured that the redirector page was the top result for certain keywords.<\/p>\n

<\/p>\n

Figure 1. Phishing attack that used poisoned search results<\/em><\/p>\n

Using this technique, phishers were able to send phishing emails that contained only legitimate URLs (i.e., link to search results), and a trusted domain at that, for example:<\/p>\n