Microsoft Accounts Compromised in Phishing Attack Targeting Energy Firms

Unknown attackers have targeted multiple energy-sector organizations by abusing Microsoft SharePoint file-sharing services. They gained initial access through previously compromised email addresses, allowing them to harvest user credentials and take over corporate inboxes. Once inside, the attackers sent out more than 600 phishing emails containing malicious SharePoint URLs designed to steal user credentials.

The phishing emails were crafted to appear legitimate, with subject lines such as “New Proposal – NDA.” Recipients included contacts both within and outside the organizations, as well as distribution lists, based on recent email threads in the compromised inboxes. The attackers monitored the victims’ inboxes, deleting any out-of-office messages and responding to inquiries about the legitimacy of the phishing attempts.

Microsoft has not disclosed how many organizations were affected or the identity of the attackers. However, they emphasized that a simple password reset is insufficient in these scenarios, as attackers can implement persistence mechanisms to maintain access to compromised accounts.

Understanding the Risks

In these types of attacks, known as attacker-in-the-middle scams, criminals can intercept and relay messages between two parties. This allows them to steal sensitive data and monitor communications. Even if victims reset their passwords, attackers may tamper with multi-factor authentication (MFA) settings to regain control.

Microsoft advises enabling MFA as a critical defense against such threats. Implementing conditional access policies can further enhance security by evaluating sign-in requests based on user signals, IP location, and device status.

Organizations should also consider investing in anti-phishing solutions that scan incoming messages and websites visited by users. These tools can help detect and mitigate phishing attempts before they lead to credential theft.

• Enable multi-factor authentication (MFA) to enhance account security against unauthorized access.
• Implement conditional access policies to evaluate sign-in requests based on user behavior and device status.
• Invest in anti-phishing products that scan incoming emails and websites to detect threats.
• Regularly monitor user accounts for suspicious activity and unauthorized access attempts.
• Educate employees about recognizing phishing attempts and the importance of verifying email sources.