dammit, message delayed email. SPAM attack:(

[chazzy2501]

A convincing message delayed (smtp delayed) email came to our staff this morning, and unfortunately at least 7 staff clicked on the link. Now 4 members of staff have been sending spam and are now blocked. I checked 3 of the staff laptops that were used and they show no sign of infection? how would this link send spam without infecting the laptop. The other staff used fixed PCs and they've not send spam (yet)

 

[3s-gtech]

Fake O365 login page?

[Shadow_Walker]

A convincing message delayed (smtp delayed) email came to our staff this morning, and unfortunately at least 7 staff clicked on the link. Now 4 members of staff have been sending spam and are now blocked. I checked 3 of the staff laptops that were used and they show no sign of infection? how would this link send spam without infecting the laptop. The other staff used fixed PCs and they've not send spam (yet)

 

[ATTACH=CONFIG]50957[/ATTACH]

 

Had it at our schools 2 weeks ago. No virus found on computers but had to reset all the users passwords.

[FishCustard]

This is a well-known phish - see the Phishing Emails thread. This regex:

 

 

([uu]nable|[Cc]annot|[Cc]lick here) ?(to)? (open|display|show|view) ?(this|full)? (e-?mail|message)

 

should catch them, add a transport rule to quarantine/block based on it. I've added "(IMAP|POP3|SMTP) (message)? delayed" to the quarantine list as well for good measure given how prevalent this seems to be. Don't want the little buggers catching on and tweaking their call to action....

Edited November 14, 2018 by FishCustard

[chazzy2501]

So I shouldn't worry about the PC? I wonder how they get the credentials of the user without a local exploit? They hit the button and it takes them to a random website, one was a guardian page about crypto currency and another took them to another schools website. They were not asked for credentials, users closed the page.

[chaplic]

Turn off user consent!

 

You know how when you install an app on your phone it says 'XYZ app wants to use your calendar and read all your contacts' ? Apps can do that with office365 and assuming the users absolutely, positively, didnt put in a password its a real and used vector. They just have to click 'ok' once, of course users never do that without reading!

 

 

As the user go to myapps.microsoft.com and see what apps the user has, and as an admin aad.portal.azure.com and enterprise apps to look for the unexpected. Whilst yo are there, look at the 'user settings' options and turn off user consent

[smithson83]

Sorry to ask what may be a simple question... @FishCustard do I just add the regex

 

([uu]nable|[Cc]annot|[Cc]lick here) ?(to)? (open|display|show|view) ?(this|full)? (e-?mail|message)

 

to a mail flow rule to match the email body/contents?

 

We had it at our place a few days ago, a few mins and several staff clicks later there were thousands of emails and dozens of users sending spam. I ended up blocking/deleting any instance of "delayed message:".

Edited November 17, 2018 by elsiegee40

[smithson83]

Sorry, belay that... Found the answer by following FishCustard's link to http://www.edugeek.net/forums/behind-red-door/177589-phishing-emails-26.html

 

The answer to add it via powershell is on page 26, not sure if the link should have taken me there, but my phone opened page 1 and I had just woken up.

Edited November 17, 2018 by smithson83

[Arthur]

The answer to add it via PowerShell is on page 26

I have copied and pasted the direct links to the relevant posts below since that thread only goes up to page 17 on my desktop PC...

 

 

 

@limawhiskey's regex (post #373)

 

• http://www.edugeek.net/forums/behind-red-door/177589-phishing-emails-15.html#post1710560
  (based on @FishCustard's regex from post #368)
   
  

  ([uu]nable|[Cc]annot|[Cc]lick here) ?(to)? (open|view|display|show) ?(this|full)? (e-?mail|message)

  
  

@Katy's PowerShell script to create an Office 365 transport rule with the regex (post #389)

 

• http://www.edugeek.net/forums/behind-red-door/177589-phishing-emails-16.html#post1712246