How Microsoft Office renewal scam is stealing money from thousands around the world

A team of cybersecurity specialists from the firm Abnormal Security has detected a malicious campaign in which threat actors try to trick users with an alleged renewal of Microsoft Office; Thousands of users around the world are exposed to this attack, so you need to know the mode of operation.

Microsoft Office offers purchase and subscription plans, and collaborates with multiple companies to sell their products and services. Threat actor groups try to take advantage of this to deploy phishing campaigns by posing as company executives and stealing confidential victims’ information for various purposes.

Esta imagen tiene un atributo ALT vacío; su nombre de archivo es renewalscam01.jpg
SOURCE: Abnormal Security

Threat actors send two emails purportedly from Microsoft inviting users to renew their Office subscription through links attached to the email text.

The attack is divided into two stages:

  • The target user is redirected to a website hosted on Wix, which contains a confidential information registration form; the form asks for information such as address and payment card number
  • Subsequently, the user is shown an alleged PayPal message. It is important to mention that although Microsoft accepts payments through PayPal, the payment option is included in the user’s Office account, not on the payment company’s site. Any payment to Microsoft made outside of the company’s official sites could be considered fraudulent

Victims of an attack could see your personal and financial information compromised, which would be useful in other stages of attack.

Esta imagen tiene un atributo ALT vacío; su nombre de archivo es renewalscam02.jpg
SOURCE: Abnormal Security

The email used by hackers is really compelling, as it employs multiple features typical of Microsoft’s legitimate notifications, which increases the chances of users falling into the trap.

Esta imagen tiene un atributo ALT vacío; su nombre de archivo es renewalscam03.jpg
SOURCE: Abnormal Security

In addition, it is necessary to consider Microsoft Office to be an essential service in virtually any business environment, so potential victims could more easily fall into deception. Finally, the researchers point out that the threat actors took the time to eye the malicious URLs, so it is not possible to distinguish the risk with only a small verification. If you receive this message or any other similar message, it is best to ignore it and notify your company’s information technology area, who will find the best way to contain th