Microsoft Sway Pages Weaponized to Perform Phishing and Malware Delivery

Risk actors have a short while ago performed phishing campaigns utilizing Microsoft Sway and employed the system to distribute malware inside of businesses. 

The conclusions arrive from cybersecurity professionals at Proofpoint, who released an advisory about the new risk on Monday.

“An attacker can weaponize a Sway website page by possibly compromising a Microsoft 365 account within the goal business (to phish additional users) or creating a Sway web site within just their individual Microsoft 365 account outside the house the concentrate on group,” reads the specialized write–up.

According to the advisory, most phishing attack vectors observed by Proofpoint included clicking a immediate hyperlink to a phishing page. The enterprise also highlighted that Microsoft ordinarily uses a warning pop–up to try to discourage people from slipping prey to these types of phishing tries.

“However, Proofpoint cloud security research suggests that attackers can phish users utilizing an embed process inside of Microsoft Sway devoid of a warning pop–up,” the company wrote. “This involves a person clicking on a website link in an embedded destructive document within just a Sway web page.”

Even more, although Microsoft only allows uploads of media documents in Sway webpages (and actively blocks uploads of executable documents), there are techniques to use Sway to distribute destructive executables by embedding the hosted malware inside of the platform.

This can be finished, as pointed out above, by hosting a destructive file on Microsoft OneDrive or SharePoint and embedding it in the new Sway site. Destructive data files can also be sent to end users within the group, who may possibly open up them even although they include malware.

“Threat actors continuously request new ways to steal users’ credentials and obtain accessibility to users’ accounts,” Proofpoint wrote. “As this web site illustrates, Microsoft Sway serves as a suitable platform for a variety of varieties of cloud attacks considering that it’s a respectable application hosted on a seemingly benign domain.”

To mitigate the effects of these threats, Proofpoint advisable organizations teach end users to be knowledgeable of Microsoft Sway–based embedded phishing and malware threats and, if vital, limit the use of Microsoft Sway in cloud environments. 

Corporations need to also established up in depth account compromise detection making use of a cloud obtain security broker (CASB) resolution and isolate end–user website traffic when people click on on inbound links in just Microsoft Sway pages.

Some parts of this article are sourced from:
www.infosecurity-magazine.com