Access to any email account can lead to a payday for cyber criminals. But not all email accounts are created equal. Domain Administrator accounts have high levels of access and are becoming specific targets of phishers.
Admins make great targets because of what can be accomplished if an attacker gains access to one of these accounts. Office 365 admins can change passwords, create new accounts, read other user’s emails and even send email as any member of the organization.
Phishers have recently started rolling out targeted campaigns to steal admin credentials. These campaigns utilize fraudulent, but convincing, Office 365 admin alert emails. Office 365 admins typically receive legitimate alerts about things like unauthorized access or if email services are impacted. Since these fake emails look so much like the real thing, some admins are falling prey and providing attackers with their credentials, opening a serious security hole.
Above is an example of one of the fake emails being used in this campaign. This email states that someone has gained access to one of the accounts in the environment. The email appears to come from a legitimate Office 365 address, but this can be spoofed to make the email appear more convincing. It then asks you to “investigate” the issue. When you click on the “investigate” button you are taken to a familiar Office 365 sign in page as seen below.
