Admins working with Microsoft Azure beware: phishers are updating their assets to reflect changes on the company’s cloud-based login screen.
Microsoft announced the innocuous change to its Azure AD login screen on 26 February, rolling it out in the first week of April. The previous screen featured a login box against a full-frame photograph in the background. In the new version, Microsoft replaced the photograph with plain colours, reducing its size by 99%. That’ll save network bandwidth and reduce page loading times, said executives at the time. Even though users may cache static page assets locally, they’ll still reload them eventually, and every little helps.
Online ne’er-do-wells work quickly, though, and it didn’t take long for phishing scammers to catch on. The company said in a tweet that it had seen multiple sites using the new background in a bid to lure Azure AD users into giving up their account info:https://platform.twitter.com/embed/index.html?creatorScreenName=NakedSecurity&dnt=true&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1260975500911980544&lang=en&origin=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F18%2Fshiny-new-azure-login-attracts-shiny-new-phishing-attacks%2F&partner=jetpack&siteScreenName=NakedSecurity&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=550px
Azure AD is the cloud-based version of the on-premises Active Directory system that holds user authentication and access privilege data. The cloud version is the single sign-on gateway to a range of online applications, including Microsoft’s own cloud services, along with third party apps. As such, it’s the holy grail for phishing scammers who could gain access to lots of enterprise accounts in the cloud if they mount a convincing attack.OTHERS STOP AT NOTIFICATION. WE
