Dynamics 365 Customer Voice, a Microsoft service for collecting customer feedback, is reported to be abused in a phishing campaign. The emails arrive through the service’s old name, Forms Pro, and claim the recipient has a new voicemail. The Play Voicemail button leads to a fake Microsoft login page that captures the credentials entered there.
What is the Dynamics 365 phishing campaign?
Security researchers reported that the Dynamics 365 Customer Voice service, a Microsoft product that institutions/organizations use to get customer feedback, is manipulated in phishing attacks by threat actors. Threat actors behind this phishing campaign are planning to seize the Microsoft account information of customers by sending phishing links that appear legitimate to customers via Dynamics 365 Customer Voice.How does the Customer Voice phishing campaign work?
The campaign starts with the delivery of a phishing e-mail to the recipients via the old name of the service, “Forms Pro,” stating that they have a new voicemail. When the Play Voicemail button is clicked, targets are directed to a phishing page that mimics the Microsoft login page. However, the URL of that phishing page has no connection with Microsoft. Therefore, Microsoft login credentials entered by targets are captured by threat actors.How can you avoid this kind of phishing?
The campaign is an attack that requires careful detection by targets, as the phishing link is not visible until the last step. Additionally, destinations are redirected from the e-mail body to a legitimate page first, so hovering over the URL in the e-mail body does not provide protection. In this context, in order not to be the target of phishing attacks that can be carried out using similar methods, attention is paid to the following security recommendations;- Users should check all URL addresses, including links in the e-mail body,
- E-mails, attachments, and links from unknown parties should not be trusted,
- Login credentials thought to have been compromised should be promptly replaced by enforcing strong password policies.