What you need to know
- Microsoft is combatting phishing attacks by seizing control of domains.
- The newest phishing attacks try to trick people with fake coronavirus-related emails.
- A recent court ruling allowed Microsoft to seize the domains utilized in the attacks.
Microsoft is combatting coronavirus-themed cybercrime by seizing control of domains used as part of the infrastructure of criminal attacks. During the coronavirus (COVID-19) pandemic, attackers have tried to take advantage of people by sending emails claiming to provide help or information related to coronavirus. Microsoft outlines its efforts in a recent blog post.
In addition to several defensive actions that Microsoft takes against these kinds of attacks, Microsoft also takes legal action when necessary. Microsoft recently filed a civil case, which resulted in a court order allowing Microsoft to seize control of key domains. By seizing these domains, Microsoft can make it more difficult for phishing emails to appear authentic.
In December 2019, Microsoft's Digital Crimes Unit (DCU) observed a new phishing scheme aimed at compromising people's Microsoft accounts. These attacks would send emails that appeared to be from Microsoft but were actually attackers maliciously using Microsoft branding and URLs that appear similar to Microsoft's official channels. According to Microsoft, the same criminals behind those attacks began a similar set of attacks that instead phished people with coronavirus-related emails.
For example, malicious emails were sent out with what appears to be an Excel spreadsheet titled "COVID-19 Bonus." The example (shown above) shared by Microsoft appears authentic, as it has the URL "@sharepointonline.com" for the sender and features copied Microsoft OneDrive branding.
If a person clicks on the deceptive links within the phishing email, they're prompted to grant access to a malicious web application. Microsoft emphasizes that web apps are used frequently by organizations, which means that people could be used to granting them permissions. The malicious web apps would then be able to access people's Microsoft Office 365 account. The prompt (shown below) asks people to grant access to several sensitive pieces of data. The prompt has a copied Microsoft logo and an icon labelled "0365" that appears similar to Microsoft's Office icon.
Microsoft lays out some steps that people and businesses can take to further protect themselves from attacks. The company recommends two-factor authentication, learning how to spot phishing schemes, and enabling security alerts for links and files from suspicious websites. Microsoft also recommends checking email forwarding rules for suspicious activity.
We may earn a commission for purchases using our links. Learn more.
Update 4: Trump gives blessing to TikTok sale to Microsoft
TikTok may soon be owned by Microsoft. The company is reportedly in talks to buy out the U.S. portion of TikTok amid a rumored Trump administration order for TikTok owner Bytedance to divest. On Monday, President Trump says he does not oppose the sale so long as it is done by September 15.
Bing might be in for a very Microsoft-y rebrand
You may want to prepare to say goodbye to Bing's iconic "B" logo. It appears Microsoft is at least mulling a move to rebrand the search engine to "Microsoft Bing" with a new logo in tow.
Even if you don't love Wonder Woman, this Edge extension is glorious
Need to add a little more spice to your new tab pages in Microsoft Edge? How about a little Wonder Woman 1984 art? Surely you can't say no to that.
Secure your business with these Dell tools
Are you an IT professional or business owner that wants to heighten security? Dell Technologies has the products you need to keep your files, hardware, and more, as secure as possible.