www.avanan.com Open in urlscan Pro
2606:2c40::c73c:6702  Public Scan

Form analysis
1 forms found in the DOM

https://www.avanan.com/search-results

<form id="avananSearch" class="js-focus-state input-group input-group-lg" action="https://www.avanan.com/search-results">
  <input style="width: 1% !important;" type="search" name="term" autocomplete="off" class="form-control" placeholder="Search Avanan" aria-label="Search Avanan">
  <div class="input-group-append">
    <button type="submit" form="avananSearch" value="Submit" class="btn btn-primary" aria-label="Search">Search</button>
  </div>
</form>

Text Content

×
Search
Quick Links
Avanan Blog Attack Briefs Events Webinars
Anti-Phishing Avanan vs ATP Contact Us About Us

   
 * Search
   
   
 * Support
   

   
 * Solutions
   Platforms
    * Microsoft 365
    * G Suite
    * Slack
    * Teams
    * File Sharing
    * All Solutions
   
   Security
    * Anti-Phishing
    * Malware & Ransomware
    * Account Takeover Protection
    * DLP & Compliance
    * Archiving
    * Incident Response-as-a-Service
   
   Read Our Case Studies
   
   See how well we have worked for different industries
   
   Learn More
   
   
 * Pricing
   
   
   
   
   
 * Why Avanan
   Why Avanan
    * How it Works
    * About Us
    * True AI
    * Threat Calculator
   
   Compare Avanan
    * Compare
    * Avanan vs Other API Solutions
    * Avanan vs Secure Email Gateways
   
   See How Others Compare
   View Now
   
   
 * Partners
   Resellers
    * Become a Reseller
   
   MSP/MSSP
    * Become a MSP/MSSP
   
   Access Our Partner Portal
   Go Now
   
   
 * Resources
   Blog
    * Attack Briefs
      
      
    * All Blog Posts
   
   Events
    * Upcoming Webinars
    * Conferences
    * Regional Events
    * All Events
   
   Resources
    * On-Demand Webinars
    * White Papers & Solution Briefs
    * Case Studies
    * Avanan Comics
    * Videos & Presentations
    * Go Phish Game
      
    * All Resources
   
   Read our Attack Briefs
   
   Breaking news and exclusive details from our white-hat hackers on advanced
   inbox threats.
   
   Learn more
   
   
 * Free Trial
 * Get Demo
   


AVANAN SUPPORT

×

DOCUMENTATION

OPEN A TICKET

`

 1. Blog Home
 2. Attack Briefs
 3. Abusing Microsoft Customer Voice to Send Phishing Links


ABUSING MICROSOFT CUSTOMER VOICE TO SEND PHISHING LINKS

 * Posted by Jeremy Fuchs on November 3, 2022
   
    * 
    * Share
    * 



Dynamics 365 Customer Voice is a Microsoft product that is used primarily to
gain feedback from customers. 

It can be used for customer satisfaction surveys, to track customer feedback and
to aggregate data into actionable insights. 

It can also be used to interact with customers via phone, with the data being
collected for more customer input.

It is here where hackers have taken notice.

Instead of using this for customer feedback, hackers are trying to steal
customer information.

In this attack brief, researchers at Avanan, a Check Point Software Company,
will discuss how hackers are using Microsoft’s Dynamic 365 Customer Voice to
send phishing links. 

Attack

In this attack, hackers are leveraging legitimate links from Microsoft
notifications to send credential harvesting pages. Avanan has seen hundreds of
these attacks in the last few weeks. 

 * Vector: Email
 * Type: Credential Harvesting
 * Techniques: Social Engineering, Impersonation
 * Target: Any end-user





Email Example #1







This email comes from the survey feature in Dynamics 365. Interestingly, you’ll
notice the sending address has “Forms Pro” in it, which is the old name of the
survey feature. The email shows that a new voicemail has been received. To the
end user, this looks like a voicemail from a customer, which would be important
to listen to. Clicking on it is the natural step. 

 

Email Example #2






This is a legitimate Customer Voice link from Microsoft. Because the link is
legit, scanners will think that this email is legitimate. However, when clicking
upon the “Play Voicemail” button, hackers have more tricks up their sleeves. The
intent of the email is not in the voicemail itself; rather, it is to click on
the “Play Voicemail” button, which redirects to a phishing link.

 

Email Example #3



 

Once you click on the voicemail link, you are redirected to a look-alike
Microsoft login page. This is where the threat actors steal your username and
password. Notice the URL is different from a typical Microsoft landing page. 

Techniques

Hackers continually use what we call The Static Expressway to reach end-users.
In short, it’s a technique that leverages legitimate sites to get past security
scanners. The logic is this: Security services can’t outright block Microsoft–it
would be impossible to get any work done. Instead, these links from trusted
sources tend to be automatically trusted. That has created an avenue for hackers
to insert themselves.

We’ve seen this a lot recently, whether it’s Facebook, PayPal, QuickBooks or
more. It is incredibly difficult for security services to suss out what is real
and what is nested behind the legitimate link. Plus, many services see a known
good link and, by default, don’t scan it. Why scan something good? That’s what
hackers are hoping for. 

This is a particularly tricky attack because the phishing link doesn’t appear
until the final step. Users are first directed to a legitimate page–so hovering
over the URL in the email body won’t provide protection. In this case, it would
be important to remind users to look at all URLs, even when they are not in an
email body.

These attacks are incredibly difficult to stop for scanners and even harder for
users to identify. 



Best Practices: Guidance and Recommendations

To guard against these attacks, security professionals can do the following:

 * Always hover all URLs, even those not in the email body
 * When receiving an email with a voicemail, ensure this is a typical type of
   email received before thinking of engaging
 * If ever unsure about an email, ask the original sender

 

 * 
 * Share
 * 

TOPICS:  

Blog
Attack Briefs

NEXT POST:

WHAT IS A VISHING ATTACK?

Check Point Software Technologies (Avanan)
Email Security
4.7
520 Ratings
Submit a review
As of 14 Dec 2023
 * Reviewed October 17, 2023
   
   "In the top tier of all email security solutions..." (read more)

 * Reviewed October 17, 2023
   
   "AI-Based email detection tool modernizing email security..." (read more)

 * Reviewed October 12, 2023
   
   "A solution to protect email in the cloud that is easy to manage ..." (read
   more)

 * Reviewed August 14, 2023
   
   "Best Email security ..." (read more)

 * Reviewed July 25, 2023
   
   "I sleep better at night with Avanan protecting us...." (read more)

 * Reviewed July 13, 2023
   
   "Great product..." (read more)

 * Reviewed June 23, 2023
   
   "Avanan just works to protect your email...." (read more)

 * Reviewed June 12, 2023
   
   "Avanan email security protects your email and collaboration suites using
   AI/ML algorithms..." (read more)

 * Reviewed June 11, 2023
   
   "Very nice, fantastic and pocket friendly cloud email security application.
   ..." (read more)

 * Reviewed June 9, 2023
   
   "Ultimate cloud cover protection against cloud phishing ..." (read more)

 * Reviewed June 5, 2023
   
   "User Experience..." (read more)

 * Reviewed May 30, 2023
   
   "Threat detection capabilities and Prevention..." (read more)

 * Reviewed May 29, 2023
   
   "Fortify your cloud collaboration and advanced threat protection with avanan
   ..." (read more)

 * Reviewed May 26, 2023
   
   "Google Workspace security and protection aginst cyber risk..." (read more)

 * Reviewed May 25, 2023
   
   "Happy Avanan customer!..." (read more)

 * Reviewed May 24, 2023
   
   "Avanan is Superior..." (read more)

 * Reviewed May 24, 2023
   
   "Avanan review..." (read more)

 * Reviewed May 24, 2023
   
   "Best Email Security Product on the Market..." (read more)

 * Reviewed May 24, 2023
   
   "Avanan will greatly reduce the amount of spam and malicious emails your org
   gets..." (read more)

 * Reviewed May 24, 2023
   
   "Avanan a powerfull solution for the protection of Email and Collaborative
   Applications..." (read more)



GET A DEMO

Experience the power & simplicity.

Learn More
   

 * POPULAR

 * Safe Links | Why Is This Microsoft Office 365 Safe Link Not Safe?
 * HTML Attachments: The Latest Phishing Trend Targeting Office 365
 * Mimecast vs. Proofpoint: Why They Can't Secure Office 365 & Gmail
 * Why Multi-Factor Authentication (MFA) Security Isn't Foolproof
 * baseStriker: Office 365 Security Fails To Secure 100 Million Email Users
 * Widespread in Office 365: Zero-Day Virus Email Ransomware Attack

CATEGORIES

 * Blog (690)
 * Attack Briefs (283)
 * News (51)
 * Case Studies (18)
 * Microsoft ATP (8)

14-Day Free Trial – Experience the power and simplicity of Avanan Cloud
Security.   Start Free Trial

ABOUT

 * About Us
 * Careers
 * Partners
 * Terms of Service
 * Privacy Policy

EXPLORE

 * Platform
 * How it Works
 * View Pricing
 * Free Trial
 * Get a Demo

GET IN TOUCH

Contact Us +1 (855) 528-2626 info@avanan.com 259 West 30th Street
New York, NY 10001
   
 * 
 * 

LATEST FROM THE AVANAN BLOG

Phishing via Genial.ly

 * View All Blog Posts →

© Copyright 2023 Avanan. All Rights Reserved.



This website uses cookies in order to optimize your user experience as well as
for advertising and analytics.  For further information, please read our Privacy
Policy and ourCookie Notice.
Cookies Settings Reject All Accept


When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

FUNCTIONAL COOKIES

Functional Cookies

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

TARGETING COOKIES

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button


COOKIE LIST



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Reject All Confirm My Choices