Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Microsoft login page abused as phishing redirector
Excerpt
Eye Security has observed threat actors using links to login.microsoftonline.com in phishing emails. Not for device code or consent phishing, but to redirect victims to malicious pages via Microsoft’s legitimate login infrastructure. Using the Microsoft login page for phishing About five months ago, at DEFCON33, Keanu Nys gave a great presentation titled “Turning Microsoft’s Login Page into our Phishing Infrastructure”. Among some other (pretty cool) attacks, he…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | damane.cloud | High | Score 58/100 | First seen |
| Domain | yukazimani.com | High | Score 58/100 | First seen |
| Domain | workers.dev | High | Score 58/100 | First seen |
| Domain | chouests.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…