{"id":409,"date":"2021-06-04T09:47:47","date_gmt":"2021-06-04T16:47:47","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=409"},"modified":"2021-06-04T09:47:48","modified_gmt":"2021-06-04T16:47:48","slug":"phishing-from-6-4-21-albright-cheryl-shared-docx-copy-with-you","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/409","title":{"rendered":"Phishing from 6\/4\/21: &#8220;Albright Cheryl shared &#8220;Docx copy&#8221; with you.&#8221;"},"content":{"rendered":"\n<p class=\"has-large-font-size\">Original Phishing Message<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"596\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-phish-1024x596.jpg\" alt=\"\" class=\"wp-image-410\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-phish-1024x596.jpg 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-phish-300x175.jpg 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-phish-768x447.jpg 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-phish.jpg 1089w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Where Did The Link Lead?<\/p>\n\n\n\n<p>The link in the phishing email leads to a benign document hosted on Microsoft Sharepoint. Generally, if you see any documents that look like the image below where it asks to &#8220;Click Here to view&#8221;, it is probably part of a phishing attempt. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"460\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1-1024x460.jpg\" alt=\"\" class=\"wp-image-411\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1-1024x460.jpg 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1-300x135.jpg 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1-768x345.jpg 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1-1536x691.jpg 1536w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1-1440x648.jpg 1440w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-1.jpg 1908w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Clicking on the &#8220;Here&#8221; links to a Microsoft Form asking for your email\/password combination. Never submit passwords in forms or enter your username\/password on sites you do not recognize. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"889\" height=\"853\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-2.jpg\" alt=\"\" class=\"wp-image-412\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-2.jpg 889w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-2-300x288.jpg 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/06\/6-4-21-o365-link-2-768x737.jpg 768w\" sizes=\"auto, (max-width: 889px) 100vw, 889px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Text of Phishing Message<\/p>\n\n\n\n<p><strong>Subject: <\/strong>Albright Cheryl shared &#8220;Docx copy&#8221; with you.<\/p>\n\n\n\n<p>Albright Cheryl shared a file with you<\/p>\n\n\n\n<p>FWD: Sabah Randhawa Has shared a File with One Drive<\/p>\n\n\n\n<p>Docx copy [<em>link removed<\/em>]<\/p>\n\n\n\n<p>This link will work for anyone.<\/p>\n\n\n\n<p>Open [<em>link removed<\/em>]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Original Phishing Message Where Did The Link Lead? The link in the phishing email leads to a benign document hosted on Microsoft Sharepoint. Generally, if you see any documents that look like the image below where it asks to &#8220;Click Here to view&#8221;, it is probably part of a phishing attempt. Clicking on the &#8220;Here&#8221; [&hellip;]<\/p>\n","protected":false},"author":521,"featured_media":410,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3],"class_list":["post-409","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=409"}],"version-history":[{"count":1,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/409\/revisions"}],"predecessor-version":[{"id":413,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/409\/revisions\/413"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/410"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}