A New Dimension of Email Scams! Leveraging Partner Relationships to Bypass Multi-Factor Authentication

In an attack campaign leveraging relationships between different organisations, threat actors managed to link Business Email Compromise (BEC) to four or more organisations, using the relationships between them to hop from one compromised organisation to another. Microsoft researchers referred to this attack as multi-stage Adversary-in-the-Middle (AiTM) phishing, which began with attacks on a trusted supplier as well as target organisations in the banking and financial services sector.

This attack demonstrates the complexity of AiTM and BEC threats, which abuse trust relationships between suppliers, distributors, and other partner organisations to commit financial fraud.

▍Phishing Using Indirect Proxy

AiTM phishing is a now-common technique used to bypass multi-factor authentication mechanisms that rely on one-time codes manually entered by users during login sessions, whether generated via email, SMS, or mobile apps. The most common way to perform AiTM is using a reverse proxy, where victims connect to an attacker-controlled domain and website that simply proxies all content and subsequent requests from the real login page of the target service.

In such phishing implementations, now available using open-source toolkits, the attacker gains a passive monitoring role over the traffic between the victim and the service they are authenticating to. The goal is to capture the session cookie forwarded back by the service when authentication is complete, and then use it to access the victim's account directly. However, if additional strategies are implemented to capture and verify other aspects of the victim's machine, this also has a downside for the attacker, as subsequent logins by the attacker may trigger security alerts and flag the session as suspicious.

In the new attack, the threat actor, tracked by the company under the temporary alias Storm-1167, used a custom phishing toolkit developed by themselves that uses an indirect proxy approach. This means the phishing page set up by the attacker does not serve any content from the real login page, but instead simulates it as a standalone page entirely under the attacker's control.

When the victim interacts with the phishing page, the attacker uses the credentials provided by the victim to initiate a login session with the real website, and then uses fake prompts to request the MFA code from the victim. If the code is provided, the attacker uses it for their own login session and directly obtains the session cookie. The victim is then redirected to a fake page. This is more in line with traditional phishing attacks.

In this AiTM attack using an indirect proxy, since the phishing website is set up by the attacker, they have more control and can modify the displayed content based on the scenario. Furthermore, because the phishing infrastructure is controlled by the attacker, they have the flexibility to create multiple servers to evade detection. Unlike typical AiTM attacks, there are no proxied HTTP packets between the target and the actual website.

▍Establishing Persistent Email Access and Launching BEC Attacks

Once connected to the victim's account, the attacker generates a new access code to extend their access time, and then proceeds to add a new MFA authentication method to the account—one using an SMS service with an Iranian number. They then create an email inbox filtering rule to move all incoming emails to the archive folder and mark them as read.

The attack began with a phishing campaign targeting employees of a company that is a trusted supplier to multiple organisations. Attackers used a URL pointing to http://Canva.com, a free online graphic design platform used to create visual presentations, posters, and other graphics. The URL pointed to a page crafted by the attacker on Canva that mimicked a OneDrive document preview. If this image is clicked, users are directed to a fake Microsoft login page for authentication.

After compromising the supplier's email account, the attacker extracted email addresses from existing email histories and sent approximately 16,000 emails, which modified similar malicious Canva URLs. Microsoft researchers stated: "The attacker then monitored the victim user's mailbox for undelivered and out-of-office emails and deleted them from the archive folder. The attacker read the recipient's emails where the recipient raised questions about the authenticity of the phishing email and replied, presumably to falsely confirm that the email was legitimate. The emails and replies were then deleted from the mailbox."

Recipients of the phishing emails from the supplier were likewise directed to the AiTM phishing page, and the attack chain continued. A victim of a second phishing campaign from a different organisation had their email compromised and used to send additional phishing emails to partner organisations. Subsequent victims' accounts were abused in a similar manner.

Like software supply chain attacks, this multi-stage AiTM phishing and BEC combination can grow exponentially and can go deep downstream into the chain of trust. The goal of BEC attacks is typically to trick recipients into initiating rogue wire transfers, sharing private personal and financial information, or transferring cryptocurrency.

This AiTM attack using an indirect proxy is an example of the growing complexity and evolving TTPs of threats to evade or even challenge traditional solutions and best practices. Therefore, proactive hunting and rapid response to threats become a more crucial aspect of securing an organisation's network security, as it provides an additional layer to other security remediations and can help address defense evasion issues.

Some mitigation solutions include using MFA methods that cannot be intercepted by AiTM techniques, such as methods using FIDO 2 keys and certificate-based authentication. Organisations can also implement conditional access policies that use additional user or device identity signals (such as IP location or device status) to evaluate login requests. In addition, Microsoft recommends implementing continuous access evaluation.

The Security Metric Validation Platform provides enterprises with a way to proactively hunt and rapidly respond to threats. Organisations continuously validate the effectiveness of their security defenses through real APT attack scenarios, proactively discovering threats they cannot defend against, thereby targetedly supplementing and optimising configurations.