Back 
概要
In July 2024, Netskope Threat Labs tracked a 2,000-fold increase in traffic to phishing pages delivered through Microsoft Sway. The majority of the credential grabbing pages investigated used “Quishing,” a form of phishing that uses QR code to trick users into accessing a malicious website. The phishing campaigns targeted MS Office credentials, using documents to bait users into logging in. The campaigns have targeted victims mainly in Asia and North America across multiple segments led by Technology, Manufacturing, and Finance.
Attackers instruct their victims to use their mobile devices to scan the QR code in hopes that these mobile devices lack the stringent security measures typically found on corporate issued ones, ensuring unrestricted access to the phishing site. Additionally, these QR phishing campaigns employ two techniques from previous posts: the use of transparent phishing and Cloudflare Turnstile. Transparent phishing ensures victims access the exact content of the legitimate login page and can allow them to bypass additional security measures like multi-factor authentication. Meanwhile, Cloudflare Turnstile was used to hide the phishing payload from static content scanners, preserving the good reputation of its domain.
Let’s take a closer look at these phishing campaigns:
Microsoft Sway abused to serve phishing content
Sway is a free application within Microsoft 365 that helps users present ideas with a web-based canvas, meaning anyone with a Microsoft account can send presentations without cost. This free access, however, makes it appealing to attackers for abuse, as we have observed previously about their propensity to use free cloud applications.
By using legitimate cloud applications, attackers provide credibility to victims, helping them to trust the content it serves. Additionally, a victim uses their Microsoft 365 account that they’re already logged-into when they open a Sway page, that can help persuade them about its legitimacy as well. Sway can also be shared through either a link (URL link or visual link) or embedded on a website using an iframe.
Over the past six months, Netskope Threat Labs observed little to no malicious traffic using Microsoft Sway. However, in July 2024, we observed a 2,000-fold increase in traffic to unique Microsoft Sway phishing pages. The pages we investigated were targeting Microsoft 365 accounts.
It is important to note that Microsoft announced in 2023 that user-facing Microsoft 365 apps and services are unified to a single and consistent domain (*[.]cloud[.]microsoft), which includes Sway (previously using sway[.]microsoft[.]com). Any rules to previously handle traffic to Microsoft Sway using domain name should be updated and users need to be cautious when a Sway page asks them to login. Use the URL format below as reference to quickly identify a Microsoft Sway page:
https://sway.cloud.microsoft/{16_alphanumeric_string}?ref={sharing_option}
Sharing options can be link, email, Twitter, etc.
QR Code Phishing (Quishing)
A lot of the phishing campaigns analyzed used QR Code phishing, or “Quishing.” Quishing is a form of phishing where attackers embed URLs in a QR code to redirect victims to a malicious website.
A QR code (quick-response code) is a type of two-dimensional matrix barcode that can store data. QR codes started becoming widely used in daily life during the COVID-19 pandemic. Restaurants began employing QR codes for customers to access menus and place orders, rather than requesting a menu from a waiter. As a result, people became accustomed to scanning QR codes. This behavior was then abused by attackers to redirect unsuspecting users to malicious websites.
Using QR codes to redirect victims to phishing websites poses some challenges to defenders. Since the URL is embedded inside an image, email scanners that can only scan text-based content can get bypassed. Additionally, when a user gets sent a QR code, they may use another device, such as their mobile phone, to scan the code. Since the security measures implemented on mobile devices, particularly personal cell phones, are typically not as stringent as laptops and desktops, victims are then often more vulnerable to abuse.
The phishing campaigns analyzed appear to be using Google Chrome and QR Code Generator PRO to generate QR codes.
Turnstile used to avoid static analysis
Some Quishing campaigns use Cloudflare Turnstile as an additional layer of protection against static website scanners. Similar to previously disclosed phishing campaigns, attackers abuse Cloudflare Turnstile so the phishing payload will be hidden from online static URL scanners. This technique prevents the domain and URL from having a bad domain reputation, so it won’t be blocked by web filtering services. As of this writing, this page is already taken down and no longer accessible.