0

Yesterday I received an odd message on MS Teams (a phishing attempt) that I've not seen before.

The message is made to look like it includes 2 parties; 1 internal and 1 external, in addition to myself.

Conversation allegedly with Harper Harris (Internal); Elech IT (External)

However, the 2 parties are actually 1 external party - with a display name set to make it look like this message may be a legitimate collaboration.

contact details show this is 1 external contact; not 2 contacts (1 internal & 1 external)

They also shared a link which differed from its target (further evidence that this was suspect rather than legit).

The link goes to a different place to the alleged URI

Our company's InfoSec team were informed / confirmed that this wasn't them testing us. They've blocked the URIs, but it seems that in Teams if you want to allow collaborating with external parties there aren't many more options to block this sort of thing until we've seen the attempt.

I also tried to report to MS via msrc.microsoft.com/report; but they don't seem to have an option for reporting phishing via Teams.

Is there anything that can be done to proactively prevent this sort of attack; even if as simple as blocking (Internal) from being used in a display name, if you want to allow external parties to connect?

Improve this question
1

1 Answer 1

Reset to default
1

Is there anything that can be done to proactively prevent this sort of attack; even if as simple as blocking (Internal) from being used in a display name?

It is not that simple. For instance the words "ꓲոtеrոаꓲ", "Intеrnal" and "Internal" look the same but are different. They are homoglyphs: they look almost the same but are different entities. Someone can try to create homoglyphs for banned words until they get one that works.

Is there a way to report this kind of abuse?

One setting that could be useful is to block external entities from initiating chats with internal users:

"Note that if External users with Teams accounts not managed by an organization can contact users in my organization is turned off, unmanaged Teams users can't search by email address to find users in your organization. All communications with unmanaged Teams users must be initiated by users in your organization."

Improve this answer
2
  • Thank-you. Agreed that such blocks aren't foolproof; just looking for any options to help lock things down.. Blocking all external identities has a significant negative side effect, and whilst we can whitelist domains, if we can find a better balance between security and usability that's preferable. I appreciate the advice though; thank-you
    – JohnLBevan
    Commented Feb 14 at 14:51
  • If an external user cannot start a conversation, you block the attack entirely because a third party can only send links if one of your users started the conversation.
    – ThoriumBR
    Commented Feb 14 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .