• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer
Lydon Solutions

Lydon Solutions

Construction Project Management Software Solutions

  • Construction Viz
  • Services
    • Business Consulting
    • Professional Services
    • Microsoft 365 Managed Services
    • Government Agencies
  • Company
  • Events
  • Blog
  • Careers
  • Contact
  • Search
  • Free Consultation
Show Search
Hide Search

cyber security

Beware of Phishing Attacks This Holiday Season

How-To | December 7, 2020

We are all somewhat distracted and more prone to rush to get tasks completed around the holidays as we focus on family and friends and the season. This year with the increase in working remotely and the rapid adoption of Office Online, SharePoint Online, OneDrive, and Teams, attackers are increasingly leveraging these platforms for phishing attacks.

We wanted to highlight a new type of threat occurring more, especially this year, in the hope we can alert you to the risks associated with using cloud services.

A New Phishing Threat to Cloud Services


With this new phishing threat, an attacker compromises a user's account, gains access to their contacts and sends malicious links from legitimate domains. The email may contain an invoice, voicemail, or similar legitimate communication that mimics regular business practices and misleads you into thinking the message has come from a colleague or partner.

After an attacker compromises a SharePoint or OneDrive account, they upload a malicious file and change the account's sharing permissions to "public" so that anyone can access it. This malicious link is then shared with the compromised users' contacts or other targeted individuals. Sometimes the link is a unique redirect URL and so it can be difficult to detect, as it would not appear on any URL reputation repository.

Some attackers have strategically placed malicious content in one compromised account while using a second account – perhaps one belonging to an important or credible individual that one might expect communication from – to send the link. Even if the second tenant's compromised account is discovered, the malicious file hosted in the first tenant would not be taken down. And so, the attack would persist.

Other similarly abused cloud-based services include Sway, Dropbox, Google APIs, Google Docs, Google Drive, and Box.

Be Careful of Phishing Attacks this Holiday Season


These types of scams are difficult to detect and even harder to block or mitigate. Please make sure to remain vigilant and question before trusting any communications, especially during this holiday season. If you have questions about phishing attacks or online security threats, don’t hesitate to reach out to our team.

Primary Sidebar

Recent Posts

Microsoft 365 Syntex AI
Microsoft News | August 9, 2023

Let Microsoft 365 Syntex AI Read and Organize Your Construction Images for You

sensitivity labels
Microsoft News | July 19, 2023

Redefining Project Permissions with Sensitivity Labels in Microsoft 365

Company News | June 13, 2023

Murph 2023 – We took the challenge!

Microsoft News | April 25, 2023

The end of an era with Microsoft SharePoint Server 2013

Microsoft 365 Loop
Microsoft News | April 14, 2023

Microsoft 365 Loop will change your work day. Are you ready?

Company News | April 7, 2023

Contractor Access Has Never Been Easier with Lydon Solutions’ Microsoft 365 Contractor Portal

Footer

About

Lydon Solutions is a WBE consulting group specializing in construction project management software solutions using Microsoft SharePoint. Learn more >

Products & Services

  • Construction Viz
  • Professional Services
  • Business Consulting
  • Microsoft 365 Managed Services
  • Government Agencies

News & Events

  • Events
  • Blog

Company

  • About
  • Careers
  • Contact Us

Join our Mailing List

  • This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
  • This field is for validation purposes and should be left unchanged.
Lydon Solutions

© Lydon Solutions

  • Sitemap
  • Privacy
  • Cookies
  • Terms of Use
  • Disclaimer