Many people leverage online platforms to organize meetings. Threat actors are aware of these meetings and exploit these spaces every chance they get. This recent attack involved the use of social engineering to mimic an email invite to a Zoom meeting. The attack tricked 10,000 users into clicking on a malicious link. 

Ten thousand users working in a major online brokerage company in North America were targeted by malicious hackers who used social engineering and brand impersonation techniques to gain the users’ trust and urged them to act swiftly. This gave users little time to think about the email and fall victim to the attack. 

The formulated email had the looks of a legitimate Zoom message sent from a real domain after bypassing the Microsoft email security product. The message was titled “[External]Zoom Meetings 11:00 AM Eastern Time [US and Canada].” The contents of the email stated, “Your participants have joined you in a meeting.” The contents of the email encouraged users to join their colleagues in the meeting by clicking on the “Start Meeting” button. 

Users were redirected to a spoofed Outlook login page after clicking on the link. This login page asked for the users’ credentials, thereby luring them into entering their account emails and passwords. 

As per the report’s details, users noted that clicking on a ‘Start Meeting’ button is a routine habit for them. Since the email contents followed a very familiar format, their brains did what they were programmed to do and acted quickly. 

It is prudent to pause, think, and take a step back in the situation of an unusual request such as an unplanned meeting, despite one’s conditioning towards day-to-day tasks. Phishing emails can be pretty easy to identify because they come with grammatical errors and links that do not lead to the websites they state. Moreover, phishing emails follow a format that resembles the original sender’s. Most times, simply hovering your computer mouse over a listed link can prevent you from a cyberattack. 

It is also wise to invest in an appropriate cybersecurity plan which involves employee training. The goal is to protect the business from the aftermath of a cybersecurity breach or phishing attack. Appropriate employee training is better than some security products even, so it is a good idea to focus on educating every individual involved in the organization. 

“Threat actors with corporate targets in sight sometimes go after individuals first. Organizations should ensure their staff is well-trained to identify phishing emails, which can help thwart targeted attacks on their personal emails. In turn, these employees will also report any phishing emails received to their company inbox to their security team. Training users to protect their credentials and to ensure they are logging into legitimate sites is also crucial,” noted Director and Security Solution Advisor at Cofense, Tonia Dudley.