Associated Incidents
Gamma, a relatively new AI-powered presentation software tool, is being abused in hyper-convincing phishing attacks that impersonate Microsoft's SharePoint and aim to steal people's login credentials.
Cybersecurity researchers Abnormal spotted the attacks in the wild, and described the phishing flow as "so polished it feels legitimate at every step."
The attack starts with a generic, quick-to-the-point phishing email being sent from a legitimate, but compromised, email account. This helps the crooks bypass standard authentication checks like SPF, DKIM, and DMARC and land the email directly into the target's inbox.
Spoofing SharePoint
The email itself is nothing out of the ordinary, and carries a PDF attachment that, in reality, is just a hyperlink, leading to a presentation hosted on Gamma, an AI-powered online presentation builder.
The presentation features the impersonated organization's logo and a message in the lines of "View PDF" or "Review Secure Documents".
The message is in the form of a hyperlink that leads to an intermediary splash page holding impersonated Microsoft branding and a Cloudflare Turnstile. That way, crooks make sure that actual humans, not basic automated security tools, access the site.
If the victim clicks on the call-to-action, they are taken to a phishing page that impersonates the Microsoft SharePoint sign-in portal.
This is where the actual theft happens, since the victims are then invited to log in using their Microsoft credentials.
Typing in the wrong credentials returns an error, prompting the researchers to conclude that the attackers have some sort of adversary-in-the-middle setup that helps them verify the credentials in real-time.
Abnormal says the attack is unique mostly because Gamma is a "relative newcomer" on the scene, only being around for a few years.
"Organizations are becoming increasingly familiar with file-sharing phishing attacks in general, and some may have even begun incorporating examples into their security awareness training. That being said, it's highly likely that the percentage of companies that have updated their cybersecurity education to include this type of phishing is low---and the number that use examples of attacks other than those exploiting household brands like Docusign and Dropbox is even lower," the researchers said.
"Thus, this kind of attack may not set off alarm bells that encourage a higher level of scrutiny from employees the way an attack that exploits Canva or Google Drive might."