This devious two-step phishing campaign uses Microsoft tools to bypass email security

Visio files emerge as a powerful phishing weapon

News By Efosa Udinmwen published 25 December 2024

• Two-step phishing evades security with user-triggered actions
• Fake Microsoft portals harvest sensitive login credentials fast
• Advanced threat detection is key to fighting phishing

A two-step phishing attack is leveraging Microsoft Visio files (.vsdx) and SharePoint, marking a new chapter in cyber deception, experts have warned.

Perception Point’s security researchers reported a dramatic increase in attacks leveraging .vsdx files.

These files, which were rarely used in phishing campaigns until now, are used as a delivery mechanism, with victims being redirected to phishing pages mimicking Microsoft 365 login portals, designed to steal user credentials.

Phishing exploits trusted platforms

Two-step phishing attacks layer malicious actions to evade detection. Instead of delivering harmful content directly, these campaigns rely on trusted platforms like Microsoft SharePoint to host seemingly legitimate files.

The attackers embed URLs within Microsoft Visio files that direct victims to malicious websites when clicked. This layered approach makes detection by traditional email security systems more challenging.

Microsoft Visio, a widely used tool for creating professional diagrams, has become a new vector for phishing. Attackers use compromised accounts to send emails containing Visio files appear to originate from trusted sources, often mimicking urgent business communications, like proposals or purchase orders to prompt immediate action.

As the attackers use stolen accounts, these emails often pass authentication checks and are more likely to bypass recipient security systems. In some instances, the attackers include .eml files within the emails, further embedding malicious URLs that lead to SharePoint-hosted files.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors