www.darkreading.com Open in urlscan Pro
2606:4700::6810:ddab  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Dark Reading is part of the Informa Tech Division of Informa PLC
Informa PLC|ABOUT US|INVESTOR RELATIONS|TALENT
This site is operated by a business or businesses owned by Informa PLC and all
copyright resides with them. Informa PLC's registered office is 5 Howick Place,
London SW1P 1WG. Registered in England and Wales and Scotlan. Number 8860726.

Black Hat NewsOmdia CybersecurityAdvertise

Newsletter Sign-Up

Newsletter Sign-Up

Cybersecurity Topics

RELATED TOPICS

 * Application Security
 * Cybersecurity Careers
 * Cloud Security
 * Cyber Risk
 * Cyberattacks & Data Breaches
 * Cybersecurity Analytics
 * Cybersecurity Operations
 * Data Privacy
 * Endpoint Security
 * ICS/OT Security

 * Identity & Access Mgmt Security
 * Insider Threats
 * IoT
 * Mobile Security
 * Perimeter
 * Physical Security
 * Remote Workforce
 * Threat Intelligence
 * Vulnerabilities & Threats


World

RELATED TOPICS

 * DR Global
 * Middle East & Africa

 * Asia Pacific

See All
The Edge
DR Technology
Events

RELATED TOPICS

 * Upcoming Events
 * Podcasts

 * Webinars

SEE ALL
Resources

RELATED TOPICS

 * Library
 * Newsletters
 * Podcasts
 * Reports
 * Videos
 * Webinars

 * Whitepapers
 * 
 * 
 * 
 * 
 * Partner Perspectives

SEE ALL


 * Cybersecurity Operations
 * Vulnerabilities & Threats
 * Endpoint Security
 * Cyberattacks & Data Breaches


MICROSOFT TAKES ACTION AGAINST PHISHING-AS-A-SERVICE PLATFORMMICROSOFT TAKES
ACTION AGAINST PHISHING-AS-A-SERVICE PLATFORM

The ONNX infrastructure has been servicing criminal actors as far back as 2017.

Dark Reading Staff, Dark Reading

November 21, 2024

1 Min Read
Source: Eric D ricochet69 via Alamy Stock Photo


Microsoft seized 240 domains belonging to ONNX, a phishing-as-a-service platform
that enabled its customers to target companies and individuals since 2017.

ONNX was the top adversary-in-the-middle (AitM) phishing service, according
to Microsoft's "Digital Defense Report 2024," with a high volume of phishing
messages during the first six months of this year. Millions of phishing emails
targeted Microsoft 365 accounts each month, and Microsoft has apparently had
enough.

ONNX promoted and sold phishing kits on Telegram using a subscription service
model, which ranged from $150 to $550 a month.



"The fraudulent ONNX operation offered phishing kits designed to target a
variety of companies across the technology sector, including Google, Dropbox,
Rackspace, and Microsoft," Microsoft said in its statement.



The attacks themselves are controlled through Telegram bots and come with
built-in, two-factor authentication (2FA) bypass mechanisms. As of late, QR code
phishing, also known as quishing, has also been enabled, targeting financial
firms' employees. ONNX uses bulletproof hosting services that allow delays in
phishing domain takedowns, as well as encrypted JavaScript code that decrypts
itself, all of which allows them to be highly effective in carrying out attacks
and evading detection.



"While today's legal action will substantially hamper the fraudulent ONNX's
operations, other providers will fill the void, and we expect threat actors will
adapt their techniques in response," stated Steven Masada, assistant general
counsel at Microsoft's Digital Crimes Unit. "However, taking action sends a
strong message to those who choose to replicate our services to harm users
online: we will proactively pursue remedies to protect our services and our
customers and are continuously improving our technical and legal strategies to
have greater impact."



A full list of the 240 domains that were seized is available online.




ABOUT THE AUTHOR

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

See more from Dark Reading Staff
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities,
data breach information, and emerging trends. Delivered daily or weekly right to
your email inbox.

Subscribe

You May Also Like

--------------------------------------------------------------------------------

Cybersecurity Operations

How a Centuries-Old Company Reached Security Maturity
Cybersecurity Operations

NSA Issues Tips for Better Logging, Threat Detection in LotL Incidents
Cybersecurity Operations

Broke Cyber Pros Flock to Cybercrime Side Hustles
Cybersecurity Operations

'Punchmade Dev' Cybercrime Rapper Launches Cash-Scamming Web Shop
More Insights
Webinars

 * The Unreasonable Effectiveness of Inside Out Attack Surface Management
   
   Dec 4, 2024

More Webinars
Events

 * Cybersecurity Outlook 2025
   
   Dec 5, 2024

More Events



EDITOR'S CHOICE

Pegasus Spyware concept with binary code background
Endpoint Security
WhatsApp: NSO Group Operates Pegasus Spyware for CustomersWhatsApp: NSO Group
Operates Pegasus Spyware for Customers
byJai Vijayan, Contributing Writer
Nov 18, 2024
4 Min Read

Laptop with Palo Alto networks logo
Cyberattacks & Data Breaches
Palo Alto Networks Patches Critical Zero-Day Firewall BugPalo Alto Networks
Patches Critical Zero-Day Firewall Bug
byBecky Bracken, Senior Editor, Dark Reading
Nov 18, 2024
3 Min Read
ChatGPT, typed out on a screen
Сloud Security
ChatGPT Exposes Its Instructions, Knowledge & OS FilesChatGPT Exposes Its
Instructions, Knowledge & OS Files
byNate Nelson, Contributing Writer
Nov 15, 2024
4 Min Read

Reports

 * Managing Third-Party Risk Through Situational Awareness
   
   Jul 31, 2024

 * 2024 InformationWeek US IT Salary Report
   
   May 29, 2024

More Reports
Webinars

 * The Unreasonable Effectiveness of Inside Out Attack Surface Management
   
   Dec 4, 2024

More Webinars
White Papers

 * The State of Cloud Native Security Report 2024

 * IDC White Paper: The Peril and Promise of Generative AI in Application
   Security

 * The State of Asset Security: Uncovering Alarming Gaps & Unexpected Exposures

 * Purple AI Datasheet

 * SecOps Checklist

More Whitepapers

Events

 * Cybersecurity Outlook 2025
   
   Dec 5, 2024

More Events




DISCOVER MORE WITH INFORMA TECH

Black HatOmdia

WORKING WITH US

About UsAdvertiseReprints

JOIN US


Newsletter Sign-Up

FOLLOW US



Copyright © 2024 Informa PLC Informa UK Limited is a company registered in
England and Wales with company number 1072954 whose registered office is 5
Howick Place, London, SW1P 1WG.

Home|Cookie Policy|Privacy|Terms of Use
Cookies Button


ABOUT COOKIES ON THIS SITE

We and our partners use cookies to enhance your website experience, learn how
our site is used, offer personalised features, measure the effectiveness of our
services, and tailor content and ads to your interests while you navigate on the
web or interact with us across devices. By clicking "Continue" or continuing to
browse our site you are agreeing to our and our partners use of cookies. For
more information seePrivacy Policy
CONTINUE




COOKIE POLICY

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms.    You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Always Active

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site.    All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

FUNCTIONAL COOKIES

Always Active

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages.    If you do not allow these cookies then
some or all of these services may not function properly.

TARGETING COOKIES

Always Active

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites.    They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button


COOKIE LIST



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Confirm My Choices