Hackread reports that widely used software-as-a-service platforms are having their customers targeted by a novel Dropbox phishing attack that circumvents multifactor authentication to facilitate malware deployment and credential exfiltration activities since the end of January.
Attackers leveraging the 'no-reply@dropbox[.]com' domain sent emails with a Dropbox-hosted PDF to employees using the Darktrace SaaS environment, which when opened established a connection with a malicious endpoint redirecting to a fraudulent Microsoft 365 login page, according to a report from Darktrace. Aside from leveraging ExpressVPN-related endpoints to obfuscate their locations, threat actors also tapped valid tokens and fulfilled MFA requirements to avert the targeted organization's MFA policy, researchers said. The report also showed that malicious activity has also been concealed through a new email rule that would transfer phishing emails to the 'Conversation History' folder. Such a development comes months after Dropbox had been exploited to facilitate a business email compromise operation that redirected targets to credential stealing sites.
