OneDrive Phishing Attack Targets Corporate Executives for Credential Theft
## Cybersecurity: Spearphishing Campaign Targeting Executives
Cybersecurity: Spearphishing Campaign Targeting Executives
A recently identified spearphishing campaign is exploiting OneDrive document-sharing notifications to target executives and senior leadership across various industries.
The Stripe OLT SOC has analyzed this sophisticated attack, which uses customized emails to impersonate internal HR communications. The emails aim to harvest corporate credentials through a fraudulent Microsoft Office/OneDrive login page.
The campaign utilizes subject lines such as "Salary amendment" or "FIN_SALARY" to create urgency among C-suite and leadership recipients. Emails appear to originate from OneDrive’s document-sharing system, prompting recipients to review an alleged shared file. The link in the email leads to a fake credential theft page mimicking Microsoft’s Office 365 login interface.
The phishing emails and login pages are personalized with the recipient's name and company details, increasing their credibility. The operation uses Amazon Simple Email Service (SES) for delivery, rotating among approximately 80 domains and subdomains to avoid detection by secure email gateways. Domains are typically registered through Mat Bao Corporation and Web Commerce Communications Limited (WebNic.cc), with DNS and nameserver services provided by Cloudflare and Luxhost.
The phishing pages are hosted on Akamai Cloud. To avoid spam filters, attackers send non-malicious emails prior to the phishing attempts, establishing familiarity with target mail servers.
The Stripe OLT SOC has analyzed this sophisticated attack, which uses customized emails to impersonate internal HR communications.
Hidden characters and obfuscation of words like "Open" and "Share" are used to evade detection. In Light Mode, buttons appear as clickable text, while in Dark Mode, concealed padding reveals randomized strings, complicating regex-based detection. Additionally, single-use phishing URLs self-destruct after access, complicating incident response.
To mitigate this threat, organizations should implement a combination of user awareness, technical controls, and proactive threat hunting:
Executive and Assistant Awareness : Conduct briefings for C-suite personnel and their assistants, emphasizing the campaign’s use of "salary amendment" themes and OneDrive notifications. Document Link Skepticism : Encourage verification of HR or payroll links and access to documents only through known corporate portals. Rapid Reporting Mechanisms : Establish clear paths for reporting suspicious emails to security teams to prevent large-scale credential harvesting. Comprehensive Training : Extend phishing simulations and training to executive support staff, who are also high-value targets. Technical Controls and IOC Hunting : Security teams should hunt for indicators of compromise (IOCs) related to this campaign and block SES-hosted emails from unrecognized subdomains and registrars.
For proactive threat detection in Microsoft Sentinel, SOC analysts recommend using the following KQL query to identify inbound emails with the observed subject lines:
EmailEvents | where Subject contains "FIN_SALARY" | where EmailDirection == "Inbound" | project Timestamp, RecipientEmailAddress, SenderMailFromDomain, Subject, ConfidenceLevel, NetworkMessageId, EmailAction
By enhancing executive vigilance, providing robust user training, and implementing targeted technical controls, organizations can defend against this advanced spearphishing campaign and protect critical corporate credentials.
Based on reporting by GBHackers.