Microsoft strikes back! The software titan has taken legal action to protect users, and in the process, seized malicious domains that were being used by coronavirus scammers to take advantage of people.
People that were affected by the pandemic.
The company revealed the details how it had been working with the US Justice System after it observed cyberattacks targeting folks who were left vulnerable by the coronavirus pandemic. According to Redmond, these activities were just another form of business email compromise attacks.
BEC, as they are known.
These attacks have grown in the past few years, and according to the 2019 cybercrime report by the FBI, last year these types of attacks cost users of $1.7 billion in losses.
Anyway, BEC attacks are usually targeted at businesses and non-profit organizations, where they are sent emails that look genuine, like invoices and payments. These are then used to collect details like banking information and login credentials from victims.
After entering these credentials, users are taken to a fake consent prompt that allowed attackers to gain access to personal data like OneDrive files, OneNote notebooks, SharePoint documents management, even Office 365 accounts.
Usually, Microsoft takes active measures to monitor and block such malicious web apps to protect users from these phishing attacks.
However, there are cases where these activities are massively scaled or cybercriminals evade the systems Microsoft has designed. This is why the firm was moved to court to take legal action against these COVID-19 themed BEC attacks to disable key domains.
The court ruled in favor of Microsoft, allowing it to take control of the domains and remove the websites without tipping off the criminals.
Another day in the trenches!
