Password expirations are a common security measure used by organisations to protect accounts and their sensitive information. The idea is that by regularly changing your password, you reduce the risk of someone accessing your account without authorisation – unless you fall for a phishing scam.
Cybercriminals are well aware of this practice and are using it to their advantage in their attacks. Today, MailGuard began blocking a new phishing scam that impersonates Outlook and has the subject “Expiration Notice”, followed by the recipient’s email address. The email uses a small fake Outlook logo, and aside from this is all plain text and relatively brief, which is in line with what you would expect from a password expiry alert. The recipient is warned that their email expires today, and in order to update it, they’re directed to click a link that appears as though it should take them to a company page.
Here's an example of the email:
After clicking the link, the user is taken to a phishing site that masquerades as a Microsoft Outlook Web App login page. The site’s design has been tailored to mimic the appearance of a genuine login portal, complete with a header that reads “Welcome to [business name] Portal”. In an attempt to enhance the façade of authenticity, the recipient’s email address is pre-populated in the username field, making it seem as though the site is fully integrated with the user’s email system.
To help the attacker evade detection and thwart takedown efforts, the phishing page is hosted using IPFS, which is a technology used for hosting files over a distributed file system.
On the page, the user is simply asked to enter their email password, which will be harvested by the attacker.
After entering their password, the victim is shown an error message which reads, "The user name or password you entered isn't correct. Try entering it again."
This message is shown twice before the victim is redirected to a legitimate Microsoft page with the message “We’re unable to complete your request”.
Password expiry notification scams are relatively common, so if the email you’ve received doesn’t appear to be legitimate but it doesn’t match what we’ve shown above, you may want to check out the ones we’ve previously reported on in June 2022 and October 2021.
MailGuard advises all recipients of this email to delete it immediately without clicking on any links. Providing your personal details can result in your sensitive information being used for criminal activity and may have a severe negative impact on your business and its financial well-being.
MailGuard urges users not to click links or open attachments within emails that:
- Are not addressed to you by name.
- Appear to be from a legitimate company but use poor English or omit personal details that a legitimate sender would include.
- Are from businesses that you were not expecting to hear from, and/or
- Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.
Many businesses turn to MailGuard after an incident or a near miss, often as a result of an email similar to the one shown above. If unwanted emails are a problem for your business, don’t wait until it’s too late.
Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.
One email is all that it takes
All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.
For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security. Talk to a solution consultant at MailGuard today about securing your company's inboxes.
Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.
