Office 365Â phishing and account compromise attempts are on the rise. Hackers are using legitimate-looking O365 emails that instruct users to login to their account via a spoofed page after their account was supposedly suspended.
Attackers can then harvest the user’s credentials, access the email account and ultimately gain access to launch attacks from within the user’s organization.
Another scary scenario is when a hacker will appear as an “insider” and impersonate the user to send emails to other insiders in effort to steal their credentials, money or other sensitive information.
O365 subscriptions have risen to over 100 million subscribers and has become a “breeding ground for highly personalized, compelling attacks,” according to Barracuda security researchers.
Researchers advise companies to implement regular user training and awareness of phishing threats, implement email security and cyber fraud defenses (such as DMARC), as well as turn on multi-factor authentication for O365.Â