Attack Target Summary
Attack Overview
Step 1: Email
The attack begins with an email containing a financially themed Adobe Creative Cloud-hosted document. This document appears to be legitimate and is shared from a verified source.
- Email passes SPF, DKIM, and DMARC checks.
- Adobe document appears trustworthy due to legitimate branding.
- Message encourages the user to view or interact with the hosted document.
Step 2: Clickable Link and Redirect
The document contains a clickable link that directs the user to a phishing site. This site is designed to mimic a Microsoft 365 login page.
- Phishing link embedded inside the Adobe-hosted file.
- Site mimics Microsoft's branding and login flow.
- Target is prompted to enter email and password credentials.
Step 3: Cloudflare Turnstile + Phishing Page
Before reaching the login page, users must complete a Cloudflare Turnstile. This adds a false sense of legitimacy while preventing automated detection.
- Cloudflare Turnstile gate blocks security scanners.
- Adds credibility to the phishing flow.
- Helps ensure only real users land on the phishing page.
Step 4: Final Destination (Spoofed Microsoft Login)
How Does This Attack Bypass Email Defenses?
This email attack bypasses traditional security solutions for several reasons, including:
- The sender domain passed all authentication checks.
- The link was hosted on Adobe Creative Cloud, a trusted service.
- Cloudflare Turnstile blocked URL scanners from analyzing the final phishing destination.
How Did Abnormal Detect This Attack?
This attack was detected using AI and ML by analyzing various factors, including:
- Behavioral anomalies from the sender and context.
- Unusual URL patterns and cloud-hosted content.
- Language analysis identifying financial urgency and deception.
By recognizing established normal behavior and detecting these abnormal indicators, a modern email security solution has the ability to prevent this attack from reaching inboxes.
Please note the exact detection mechanism from Abnormal Security's system might include proprietary techniques and methodologies not disclosed here.
