Hackers Exploiting .onmicrosoft.com Domains to Launch TOAD Scam Attack
Recent activities have highlighted how cybercriminals are leveraging legitimate Microsoft infrastructure to bypass security filters and execute Telephone-Oriented Attack Delivery (TOAD) scams. This is achieved by exploiting .onmicrosoft.com domains…
Recent activities have highlighted how cybercriminals are leveraging legitimate Microsoft infrastructure to bypass security filters and execute Telephone-Oriented Attack Delivery (TOAD) scams. This is achieved by exploiting .onmicrosoft.com domains assigned to Azure tenants, allowing attackers to send malicious invitations that appear to originate from trusted Microsoft sources.
The attack involves setting up a controlled tenant and sending Microsoft invitations filled with social engineering tactics. These messages often prompt recipients to contact a fraudulent support number to address billing issues or subscription confirmations.
Because these invitations are sent through legitimate Microsoft infrastructure, they have a high domain reputation, enabling them to bypass standard email gateways that typically filter unknown sources. While Microsoft Defender for Office 365 (MDO) frequently flags these attempts as phishing, relying solely on automated detection is insufficient. Attempts to mitigate these attacks by configuring Entra External Identity to restrict B2B access have proven ineffective against this method.
It is advised to configure a specific Exchange Transport Rule to counter this threat. Blocking the domain entirely is not feasible due to potential disruptions to legitimate administrative traffic. Instead, administrators should use Regular Expressions (Regex) to target specific patterns associated with these attacks without affecting legitimate Microsoft Online Email Routing Addresses (MOERA).
The attack involves setting up a controlled tenant and sending Microsoft invitations filled with social engineering tactics.
The recommended Regex to inspect the message body is:
Domain:\s+([A-Za-z0-9]+)\.onmicrosoft\.com
Implementing this rule demands caution, as some legitimate contractors or vendors may use the default .onmicrosoft.com domain. Organizations should audit their traffic to identify legitimate partners using this domain and either whitelist them or request an update to a custom-branded domain to ensure communication remains uninterrupted.
Based on reporting by Cyber Security News.