naxwell.blogg.se

Not only does this bypass traditional mail filters, but it also goes undetected by any existing web proxy and firewall controls. This is a sophisticated attack because, by using Dropbox Transfer to send files, it is not necessary to spoof headers, as the sender name will come from the legitimate Dropbox domain. And even for vigilant email recipients who check the sender address, an automated message from the domain does look innocuous enough to at least click on the links provided. There is a sense of urgency in the message, which states, "Heads up, this transfer expires in 4 days on June 10, 2020.” It appears that if the recipient doesn't download the file within the given timeframe, the file will expire and they might assume that the opportunity to receive relief funding will be missed or delayed.

Why the Dropbox Transfer Attack is Effective From there, this account takeover can lead to data or financial loss for the organization, and the account itself can be used to send additional attacks on employees, customers, or partners. The moment they do so, their Microsoft credentials on all accounts are compromised, providing access to Outlook, SharePoint, OneDrive, Teams, and other Microsoft applications. In order to access the fake document, the user must input their Office 365 credentials. This is where the intent is revealed, which is to gain access to the user's Microsoft credentials. In the second step, the landing page contains an O365 image with a button to “Access Document”. First, the recipient must click the link provided in the email, which leads to a standard Dropbox transfer landing page with the enablement to download the file.Īfter clicking on the download button, the page is redirected to a phishing landing page. The body contains a link to the file “COVID-19-Relief-Payment.PDF” with information about the size of the file, a brief description of the file, and the expiration date. The email itself is an automated message from the sender “ which is an official Dropbox domain. In this attack, threat actors use a Dropbox link and landing page to do so. Since applicants are expecting email correspondence, this provides attackers with a unique opportunity to impersonate legitimate authorities and extract sensitive information from customers.

This allows attackers to exploit current efforts by the government, particularly since applicants to these funds typically have to provide documents to prove their eligibility. As the COVID-19 pandemic continues, governments worldwide are providing relief funds for small business owners impacted by lockdowns and closures.