Cofense Reports Phishing Campaigns Using Fake Microsoft and Google Calendar Invites
.PNG)
Summary
Cofense observed spoofed Microsoft and Google Calendar invites with links to fake login pages that harvest credentials. It recommends checking sender details and URLs and using phishing defenses.
Key points
- The observed campaigns used spoofed calendar invitations designed to resemble Microsoft or Google messages and encourage clicks.
- Some messages used randomized sender addresses, familiar branding, or urgency to appear legitimate and evade filtering.
- Embedded links redirected recipients to fake Microsoft login pages hosted on non-Microsoft domains.
- Cofense said stolen credentials could be used to target other employees; the article does not report confirmed account compromises.
- The article provides observed infection and payload URLs and related IP addresses.
- Recommended precautions include checking sender addresses and URLs before clicking and deploying phishing detection and response defenses.
Article Details
- Event Type
- Calendar-invitation phishing campaigns using spoofed Microsoft and Google Calendar invites to direct recipients to credential-harvesting pages.
- Impact
- The campaigns sought to steal login credentials. The article says stolen accounts could be used for further phishing within target organizations, potentially increasing the risk of a company data breach.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]21[.]1[.]173 | Listed as an IP associated with observed payload URLs. |
| IPV4 | 104[.]21[.]21[.]48 | Listed as an IP associated with an observed infection URL. |
| IPV4 | 162[.]214[.]112[.]174 | Listed as an IP associated with observed payload URLs. |
| IPV4 | 172[.]67[.]129[.]169 | Listed as an IP associated with observed payload URLs. |
| IPV4 | 172[.]67[.]196[.]105 | Listed as an IP associated with observed infection URLs. |
| IPV4 | 18[.]160[.]10[.]51 | Listed as an IP associated with an observed infection URL. |
| IPV4 | 18[.]160[.]10[.]68 | Listed as an IP associated with an observed infection URL. |
| IPV4 | 18[.]160[.]10[.]70 | Listed as an IP associated with an observed infection URL. |
| IPV4 | 18[.]160[.]10[.]72 | Listed as an IP associated with an observed infection URL. |
| IPV4 | 185[.]208[.]158[.]92 | Listed as an IP associated with observed payload URLs. |
| IPV4 | 69[.]49[.]231[.]24 | Listed as an IP associated with observed payload URLs. |
| URL | hxxps[:]//135947[.]lachinadragon[.]com/? | Observed payload URL associated with the calendar-phishing campaign. |
| URL | hxxps[:]//6612271478[.]sbs/google[.]php | Observed payload URL associated with the calendar-phishing campaign. |
| URL | hxxps[:]//a[.]insgly[.]net/api/trk?id=emailclick&i=660735&eid=156538024&url=hXXps://abramge[.]com[.]br/drive/itpresented | Observed infection URL in a calendar-phishing campaign; redirects through a[.]insgly[.]net to the listed destination. |
| URL | hxxps[:]//abramge[.]com[.]br/drive/itpresented// | Observed payload URL associated with the calendar-phishing campaign. |
| URL | hxxps[:]//amasorightdropwaysinboxonline[.]conveyed[.]it[.]com/a8pqN/?e= | Observed payload URL associated with the calendar-phishing campaign. |
| URL | hxxps[:]//d60c1a[.]startprogrammingnowbook[.]com/?auth=2&qrc=ZWxzLmZ&sso_reload=true | Observed payload URL associated with the calendar-phishing campaign. |
| URL | hxxps[:]//itsleannepelosi[.]com/?sjzkrkrp | Observed payload URL associated with the calendar-phishing campaign. |
MITRE ATT&CK
T1078 · Valid AccountsThe article says harvested credentials could enable account compromise and follow-on phishing within target organizations.T1204.002 · Malicious FileThe campaign relied on recipients clicking convincing calendar-invitation buttons or links to trigger phishing redirects.T1566.002 · Spearphishing LinkCalendar invitations contained links that redirected recipients to credential-harvesting pages.
Products
Google CalendarCofense PDC observed threat actors using spoofed Microsoft and Google Calendar invitations with embedded malicious links that redirect victims to fake login pages to harvest credentials.Outlook[T1204.002 ] User Execution: Malicious Link – The campaign relied on users clicking visually convincing Outlook/Google Calendar-style buttons or links to trigger the phishing redirect.