Phishing Chain Targeting Outpost24 Executive Was Blocked
Summary
Specops says a phishing attempt targeting an Outpost24 C-level executive was blocked before compromising systems or affecting users. The chain used trusted Cisco and Nylas redirects and a Microsoft 365 credential-harvesting page; attribution remains unclear.
Key points
- Specops reported that the phishing attempt targeted a C-level executive at parent company Outpost24 and was blocked before compromising systems or affecting users.
- The message impersonated JP Morgan and mimicked an existing email thread to persuade the recipient to review and sign a document.
- Specops says the email used two DKIM signatures so it would pass DMARC authentication.
- The link routed through Cisco infrastructure at secure-web[.]cisco[.]com and the Nylas email API platform, before passing through other legitimate services to reach the phishing infrastructure.
- Specops said the timing of a domain’s DNS release, re-registration, and new TLS certificates strongly suggested it had been reacquired for the campaign.
- The final page used a browser validation check and a fake Outlook loading animation to harvest Microsoft 365 credentials and verify them through a login attempt.
- Specops said the tactics resemble those used by Iran-linked actors, but noted other groups use similar methods and attribution remains elusive.
Article Details
- Attack Vectors
- A phishing email impersonated JP Morgan and appeared to continue an existing email thread, inviting the recipient to review and sign a document.
- The email linked through Cisco and Nylas services, then a subdomain on a legitimate development company’s website, a re-registered domain, and phishing infrastructure behind Cloudflare.
- The final phishing page imitated Outlook and attempted to capture Microsoft 365 credentials; it also checked whether the submitted credentials appeared valid.
- Defensive Notes
- Specops reported that the attack was identified early and blocked before it compromised systems or affected users.
- The email’s links passed Cisco Secure Email Gateway validation, and the attackers chained redirects through legitimate services to make filtering and reputation-based blocking more difficult.
- A browser validation check was presented at the phishing infrastructure stage, likely to hinder security analysis, according to Specops.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe final phishing page was designed to harvest Microsoft 365 credentials and check whether the submitted credentials were valid.T1566.002 · Spearphishing LinkThe phishing email invited the executive to follow a link to review and sign a document.T1583.001 · DomainsSpecops said the timing of a domain’s re-registration and new TLS certificates strongly suggested it had been reacquired and repurposed for the campaign.T1656 · ImpersonationThe phishing email impersonated JP Morgan and was made to look like part of an existing email thread.
Vendors
CiscoWithin the message, the attackers included a ‘review document’ link pointing to the legitimate Cisco domain secure-web.cisco.com, which is typically used for rewriting URLs in emails after they have been validated byCloudflareThe user was redirected once again, this time to phishing infrastructure that was deployed behind Cloudflare to hide its origin server.MicrosoftFinally, the victim would be served a convincing phishing page meant to harvest Microsoft 365 credentials.NylasThe next step in the chain involved a redirection to the legitimate email API platform Nylas, which was likely used to ensure that the phishing link would redirect through Cisco Secure Web infrastructure.
Products
Microsoft 365 Apps for EnterpriseFinally, the victim would be served a convincing phishing page meant to harvest Microsoft 365 credentials.Outlook“Like the rest of the attack chain, this step is also carefully constructed, from a fake loading animation imitating Outlook to a check that validates whether the user input is actually an email.
Tools
Countries
Industries
CybersecurityThe cybersecurity firm confirmed to SecurityWeek that the individual targeted in this attack attempt was a C-level executive at its parent company Outpost24, underlining the sophistication of the attack.Financial ServicesThe phishing message, impersonating financial services provider JP Morgan, appeared as if part of an existing email thread to increase its sense of legitimacy, and invited the recipient to review and sign a document.