A new phishing campaign impersonating the United States Department of Labor asks recipients to submit bids to steal Office 365 credentials.
The phishing campaign has been ongoing for at least a couple of months and utilizes over ten different phishing sites impersonating the government agency.
Spoofed addresses and server abuse
In a new report by email security firm INKY, who shared the report with Bleeping Computer before publication, researchers illustrated how the phishing attack is used to steal credentials.
The emails are sent from spoofed domains that look as if they came from the actual Department of Labor (DoL) site, while some are based on a set of newly created look-alike domains such as:
- dol-gov[.]com
- dol-gov[.]us
- bids-dolgov[.]us
Most of the emails pass through abused servers owned by non-profit organizations to evade email security blocks.
Source: INKY
In other cases, they are sent through newly registered and unreported domains that aren’t yet included on anti-phishing lists.
The sender pretends to be a senior DoL employee who invites the recipient to submit their bid for an ongoing government project.
Source: INKY
The emails contain a valid letterhead, professionally-arranged content, and a three-page PDF attachment of a seemingly legitimate form.
Source: INKY
The PDF contains a “BID” button, which, if clicked, takes the victim to one of the phishing sites. INKY has confirmed the following landing pages as part of this campaign:
- opendolbid[.]us
- usdol-gov[.]com
- bid-dolgov[.]us
- us-dolbids[.]us
- dol-bids[.]us
- openbids-dolgov[.]us
- open-biddolgov[.]us
- openbids-dolgov[.]com
- usdol-gov[.]us
- dolbids[.]com
- openbid-dolgov[.]us
- dol[.]global
The spoofed site looks convincing, containing identical HTML and CSS to the real one. The threat actors have even included an instructions pop-up message to direct victims through the bidding (phishing) process.
Source: INKY
Those who bid for a project will be taken to a credential harvesting form that targets their Microsoft Office 365 email address and password.
Source: INKY
No matter what’s inputted there, the website returns a bogus error to trick the victim into entering them again, thus reducing the chances of stealing mistyped credentials.
If the victim falls for the trap for a second time, they are eventually re-directed to the actual DoL site, left with little evidence as to what exactly has happened.
Similar campaigns on the rise
This campaign’s level of sophistication and diligence in setting up convincing web pages and writing error-free phishing emails is worrying.
We saw something similar in December 2021, with phishing actors impersonating Pfizer and using well-crafted PDF attachments to invite recipients to submit bids to the pharmaceutical company.
In this case, the actors take things one step further by abusing legitimate mail servers to send their phishing lures.
Unfortunately, all that leaves email recipients with is very subtle evidence of the trickery targeting them, so ultimate vigilance is advised.
In this case, the most obvious sign of the scam would be the Department of Labor requiring anyone to log in with Office 365 credentials to view a document, something that isn’t the case on any U.S. government website.
Source: www.bleepingcomputer.com