Support IT fake password expiry

Forums › IT Pro and developers › Support IT fake password expiry

Dynamic

3836 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#290205 27-Oct-2021 15:11

Is anyone else seeing these fake 365 password expiry notifications across their client base? We've had three clients report it so far. Supposedly from Support IT which caught my eye as there is a reputable local company called Support IT that looks after my kids primary school's computers.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Referral links to services I use, really like, and may be rewarded if you sign up:
PocketSmith for budgeting and personal finance management. A great Kiwi company.

chevrolux

4962 posts

Uber Geek
Inactive user

#2802057 27-Oct-2021 15:27

Just had a bunch show up in our "general" mailboxes like info, helpdesk, accounts, etc.

Dynamic

3836 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2802059 27-Oct-2021 15:31

Thank you @chevrolux

I was a touch concerned it may have been just us.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Referral links to services I use, really like, and may be rewarded if you sign up:
PocketSmith for budgeting and personal finance management. A great Kiwi company.

clinty

1180 posts

Uber Geek

Lifetime subscriber

#2802060 27-Oct-2021 15:34

I got one as well - hopefully the filter grabs them shortly and they magically disappear from the inboxes

MS has been warning about attempts to phish MSPs, guess we look like big fish lol

regards,

Clint

freitasm

BDFL - Memuneh
79141 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2802063 27-Oct-2021 15:44

Just normal background noise. The first clue would be the sender email domain "coolmaterial.com" which I suspect is not your company or the support company you use. Then why send this to someone at yahoo.com and copy you? Why involve someone outside your domain at all?

Then the text has "passowrd" - and the "use your current password to avoid losing access" since Office 365 doesn't ask you to enter a password to keep it. Also just hovering the link provided and you will see it goes to a domain that is not Office 365 and it's not your company's domain.

clinty

1180 posts

Uber Geek

Lifetime subscriber

#2802064 27-Oct-2021 15:44

had 5 minutes so threw the header into an analyzer

https://mxtoolbox.com/Public/Tools/EmailHeaders.aspx?huid=7ab5e142-e9d2-4958-866d-45d8afa5881a

Has the X-mailer etc set as Mailchimp, so looks like it starts with Mailchimp, then bounces to Yahoo ( possibly they spoof this bit and they just drop it straight to an MS endpoint )

All the SPF and DKIM checks fail -X-MS-Exchange-Authentication-Results : spf=fail (sender IP is 159.223.13.158) smtp.mailfrom=015935.xyz; dkim=fail (signature did not verify) header.d=fbl.mcsv.net;dmarc=none action=none header.from=coolmaterial.com;

Clint

CYaBro

4565 posts

Uber Geek

ID Verified

Trusted

#2802067 27-Oct-2021 15:55

I got one today too.

Opinions are my own and not the views of my employer.

Dynamic

3836 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2802079 27-Oct-2021 16:19

freitasm:

Just normal background noise.

Yes, you are of course correct. With a few clients receiving in quick succession, there was a slight suspicion one of our contact lists had been compromised. Any facility we have with client contact info is 2FA'd but a tiny risk always remains.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Referral links to services I use, really like, and may be rewarded if you sign up:
PocketSmith for budgeting and personal finance management. A great Kiwi company.

Wise

Send money globally for less with Wise - one free transfer up to NZ$900 (affiliate link).

martyyn

1961 posts

Uber Geek

ID Verified

Subscriber

#2802087 27-Oct-2021 16:32

Yep, had a couple on clients "admin@" accounts this afternoon, not being noted as junk by Outlook though.

1101

3121 posts

Uber Geek

#2802442 28-Oct-2021 09:04

Dynamic:

Supposedly from Support IT which caught my eye as there is a reputable local company called Support IT

Just coincidence ?
We've seen Spam supposedly coming from a company name VERY similar to ours (we got a few calls about it) .

fairly generic company names being used by spammers I guess .

Ive also had a instance where spammers would get info from a companies website , deduct who the accounts person is & their email , and use that to start sending fake invoices
and fake overdue payment emails .
I allways advise to never put staff email adresses on websites, but they never take that advice.