Security firm Lookout uncovered an ongoing spear-phishing campaign aimed at NGOs, including human rights organizations such as the Red Cross, UNICEF, the UN World Food and the UN Development programs.
The analysis of the server infrastructure behind the campaign shows that the attackers have to be active at least since March 2019. The company immediately reported his findings to targeted organizations and law enforcement agencies.
The domains used in the campaign were not labeled as malicious by services like Google Safe Browsing.
Experts noticed that the threat actors employed several noteworthy techniques in this campaign, such as the ability to detect mobile devices and to log keystrokes.
The experts also collected evidence of keylogging functionality embedded in the password field of the phishing login pages. After the victims provided their credentials to bogus Office 365 login forms, the sites display customized pages to show that the users successfully’ log into their accounts.
The sites used in the campaign use SSL certificates to appear as legitimate Microsoft Office 365 login pages.
“SSL certificates used by the phishing infrastructure had two main ranges of validity: May 5, 2019 to August 3, 2019, and June 5, 2019 to September 3, 2019.
Experts pointed out that major browsers will alert users about the use of expired SSL certificates, this means that expired SSL certificates observed on some of the phishing sites can precious information on the campaign.
Below the list of certificates used in the
|Target Organization||URL||Live SSL Certificate|
|UN World Food Programme||fs.auth.wfp.org.adfs.ls.client-request-id.session-services.com||Valid until November 23|
|United Nations Development Programme||logon.undp.org.adfs.ls.client-request-id.session-services.com||Valid until November 18|
|United Nations||sso.united.un.org.adfs.ls.clinet-request-id.session-services.com||Valid until November 15|
|UNICEF||login.unicef.org.adfs.ls.client-request-id.session-services.com||Valid until November 16|
|Heritage Foundation||heritage.onelogin.com.login.service-ssl-check.com||Valid until November 18|
|International Federation of the Red Cross and Red Crescent Societies||sts.ifrc.org.adfs.ls.client-request-id.session-services.com||Valid until November 16|
|United States Institute of Peace||login.microsoftonline.com.common.oauth2.ip.session-services.com||Expired August 3|
|Concern Worldwide||login.microsoftonline.com.common.oauth2.co.session-services.com||Expired September 8|
|Humanity and Inclusion (French)||login.microsoftonline.com.common.oauth2.hi.session-services.com||Expired September 7|
|Social Science Research Council Sign-On Portal||sso.ssrc.org.adfs.ls.client-request-id.63f91e15.service-ssl-check.com||Expired September 3|
|UC San Diego||login.microsoftonline.com.common.oauth2.uc.session-services.com||Expired August 3|
|East-West Center||eastwestcenter.org.owa.auth.logon.aspx.replacecurrent.service-ssl-check.com||Expired September 3|
|Unknown/ Inaccessible||login.microsoftonline.com.common.oauth2.br.session-services.com||Expired August 3|
|Unknown/ Inaccessible||login.microsoftonline.com.common.oauth2.client.us.service-ssl-check.com||Expired September 3|
|Unknown/ Inaccessible||login.microsoftonline.com.common.oauth2.client.al.service-ssl-check.com||Expired September 3|
|Unknown/ Inaccessible||login.microsoftonline.com.common.oauth2.client.hi.service-ssl-check.com||Expired September 3|
|Yahoo (German)||login.yahoo.com.manage-account.src-ym.lang-en-us.session-services.com||Expired August 3|
|AOL (German)||login.aol.com.account.challenge.oauth.session-services.com||Expired August 3|
At the time, it is not clear the motivation behind the
(SecurityAffairs – iCloud, zero-day)