Popular AI program spoofed in phishing campaign spawning fake Microsoft Sharepoint logins

Date:
Thu, 17 Apr 2025 13:02:00 +0000

Description:
Crooks were seen using Gamma in their phishing attack chain, researchers say.

FULL STORY ======================================================================Hackers are using stolen email accounts to launch phishing attacks They are creating fake landing pages through Gamma AI,e xperts warn The goal is to steal Microsoft login credentials

Gamma, a relatively new AI-powered presentation software tool, is being
abused in hyper-convincing phishing attacks that impersonate Microsofts SharePoint and aim to steal peoples login credentials.

Cybersecurity researchers Abnormal spotted the attacks in the wild, and described the phishing flow as so polished it feels legitimate at every step.

The attack starts with a generic, quick-to-the-point phishing email being
sent from a legitimate, but compromised, email account. This helps the crooks bypass standard authentication checks like SPF, DKIM, and DMARC and land the email directly into the targets inbox.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnions advanced risk assessment tools.

Preferred partner ( What does this mean? ) View Deal Spoofing SharePoint

The email itself is nothing out of the ordinary, and carries a PDF attachment that, in reality, is just a hyperlink, leading to a presentation hosted on Gamma, an AI-powered online presentation builder.

The presentation features the impersonated organizations logo and a message
in the lines of View PDF or Review Secure Documents.

The message is in the form of a hyperlink that leads to an intermediary
splash page holding impersonated Microsoft branding and a Cloudflare Turnstile. That way, crooks make sure that actual humans, not basic automated security tools, access the site.

If the victim clicks on the call-to-action, they are taken to a phishing page that impersonates the Microsoft SharePoint sign-in portal.

This is where the actual theft happens, since the victims are then invited to log in using their Microsoft credentials.

Typing in the wrong credentials returns an error, prompting the researchers
to conclude that the attackers have some sort of adversary-in-the-middle
setup that helps them verify the credentials in real-time.

Abnormal says the attack is unique mostly because Gamma is a relative
newcomer on the scene, only being around for a few years.

Organizations are becoming increasingly familiar with file-sharing phishing attacks in general, and some may have even begun incorporating examples into their security awareness training. That being said, its highly likely that
the percentage of companies that have updated their cybersecurity education
to include this type of phishing is lowand the number that use examples of attacks other than those exploiting household brands like Docusign and
Dropbox is even lower, the researchers said.

Thus, this kind of attack may not set off alarm bells that encourage a higher level of scrutiny from employees the way an attack that exploits Canva or Google Drive might. You might also like AI agents can be hijacked to write
and send phishing attacks Take a look at our guide to the best authenticator app We've rounded up the best password managers



======================================================================
Link to news story: https://www.techradar.com/pro/security/popular-ai-program-spoofed-in-phishing- campaign-spawning-fake-microsoft-sharepoint-logins


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)