Cybercriminals have started using Static Web Apps, an Azure service, in their phishing attacks against Microsoft 365 users.
These features have been used by threat actors to host static landing phishing pages, the researchers are now saying. These landing pages look almost identical to official Microsoft services, with the company logo, and the Single SignOn (SSO) option that harvests Office 365, Outlook, or other credentials.
Reporting on the findings, BleepingComputer says using Azure Static Web Apps to target Microsoft users is an “excellent tactic”, as each landing page gets its own secure page padlock in the address bar, due to the *.1.azurestticapps.net wildcard TLS certificate.
With such a TLS certificate, even the most suspicious of victims could be tricked.
It also makes the landing pages good for targeting users on other platforms and other email providers, as these victims could also be fooled by the fake security assurance of the legitimate Microsoft TLS certificate.
Usually, when a person is suspecting a phishing attack, they’d check the URL they’re being invited to click. Using Azure Static Web Apps renders this advice useless, as many will most likely be fooled by the azurestticapps.net, and think the identity is legitimate, the publication concludes.
Azure Static Web Apps Microsoft’s tool that helps developers build and deploy full stack web apps to Azure, from a code repository.
Microsoft is silent on the matter, for the time being.
- If you’re looking to keep your devices secure, make sure to get one of the best endpoint protection services right now
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.