Senior Managers Give Up Credentials To Reschedule Meetings
By: Jim Stickley and Tina Davis
March 1, 2019
Attention senior managers, including C-Level executives and board members, and everyone else who attends meetings as a normal part of the day. Researchers at GreatHorn have discovered a phishing attack that specifically targets those in senior level positions, but the reality is that it can apply to anyone and everyone at any time. It involves rescheduling meetings and results in the victims giving up Microsoft Office 365 login credentials, which can mean potentially giving up a lot more if you’re an executive.
It works like this: The email address of the CEO is spoofed in a message that says a board meeting has been rescheduled. The subject line includes the company name as well, all to get the attention of the readers. The text in the message is simple and just states the meeting is rescheduled and requests the readers participate in a poll to pick a new date for the meeting. Of course, there is a link and it goes to a webpage that looks like a Microsoft Office page within Office 365. The users are to enter their login credentials and that’s it. The attackers have what they are after.
Scammers who do this know that people are more likely to open email messages if they appear to come from someone known to them; especially if that someone is their boss. Always be cautious about clicking links that you are not expecting to receive, regardless of who sends them. Just place a quick phone call to the CEO’s office or send a new email message and confirm. Just don’t hit the “reply” button. Likely, it’ll just go back to the scammer.
As a separate note, this scam is a bit different if the email message is viewed on a mobile device. The subject doesn’t reference a board meeting, but instead is something like “Note to Self.” Otherwise, the rest is the same.
The researchers think this is still wildly active and making its way around quickly. The URL that is used is still up and active. They also advise users to watch out for a subject of “[Company Name] February in-person Board Mtg scheduling (2/24/19 update)].” Expect those February references to change as the year moves along.