Example of either in-app phishing or link backdooring

pushsecurity / saas-attacks

Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown

https://pushsecurity.com/blog/saas-attack-techniques/

Creative Commons Attribution 4.0 International

1.18k stars 83 forks source link

Example of either in-app phishing or link backdooring #69

Closed jukelennings closed 3 months ago

jukelennings commented 4 months ago

https://www.itpro.com/cloud/cloud-security/hundreds-of-enterprises-are-being-targeted-in-a-microsoft-azure-cloud-account-takeover-campaign-heres-what-you-need-to-know

jukelennings commented 3 months ago

I haven't been able to find any technical source that makes it truly clear how the documents were delivered to targets or general details around it beyond "shared documents".

This is one I can't be 100% sure of but it seems most likely that "shared documents" did mean putting malicious links inside a document and then using document sharing functionality and so it would most closely align with in-app phishing if so. On balance of probabilities, I'll include as a reference.