Cybersecurity researchers are alerting the public to a phishing campaign targeting Microsoft OneDrive users, which employs a malicious PowerShell script to compromise systems.
Trellix security researcher Rafael Pena explained, “This campaign heavily relies on social engineering tactics to deceive users into executing a PowerShell script, thereby compromising their systems.”
Dubbed OneDrive Pastejacking, the attack involves an email containing an HTML file that mimics a OneDrive error message. The message misleads users with instructions to update the DNS cache manually by executing a series of steps, including running a Base64-encoded command in PowerShell.
The malicious command flushes the DNS, creates a folder on the C: drive, downloads an archive file, and executes a script using AutoIt3.exe. This campaign has been detected in the U.S., South Korea, Germany, India, Ireland, Italy, Norway, and the U.K.
ReliaQuest, Proofpoint, and McAfee Labs have also identified similar phishing techniques, highlighting the growing prevalence of such attacks. Additional phishing strategies involve fake Microsoft Office Forms and invoice-themed lures to steal Microsoft 365 credentials.
OneDrive Phishing Scam Tricks Users into Running Malicious PowerShell Script https://t.co/kzT1yDnGcM
— The Cyber Security Hub™ (@TheCyberSecHub) July 30, 2024
Adversaries continue to find new ways to bypass Secure Email Gateways (SEGs). Recent reports from Cofense reveal that attackers are disguising HTML payloads as MPEG files in ZIP archives to evade detection, exploiting the limitations of common archive extraction tools.
As phishing tactics evolve, staying vigilant and informed is crucial to maintaining cybersecurity.
Start Growing with Cloudways Today.
Our Clients Love us because we never compromise on these
Abdul Rehman
Abdul is a tech-savvy, coffee-fueled, and creatively driven marketer who loves keeping up with the latest software updates and tech gadgets. He's also a skilled technical writer who can explain complex concepts simply for a broad audience. Abdul enjoys sharing his knowledge of the Cloud industry through user manuals, documentation, and blog posts.
