0

I have received an email, claiming to be from Microsoft.

Here is a snapshot of it:

enter image description here

Google marked this email as spam with the following notice:

enter image description here

These are some header details:

enter image description here

Now, the text of the email is clearly nonsensical, but the reply address seems legit and the email does not contain any obvious links. What is the attacker trying to achieve here?

  • 3
    It is hard to tell with only an image of the mail. But it could be a test or an yet incomplete phishing attempt. I've also seen phishing mails with an incompletely filled out phishing templates, mails with broken MIME structure so that attachments are only shown in specific mail clients etc. Maybe more could be said by having the complete source code of the mail. – Steffen Ullrich Jun 25 '16 at 9:50
  • 1
    Establishing trust. The real scam comes later. – Natanael Jun 25 '16 at 18:30
2

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent.

A check of the SPF records for email-2.microsoft.com shows:

v=spf1 include:customers.clickdimensions.com ~all

That means clickdimensions.com is known to handle the e-mail traffic out of Azure, and Microsoft themselves uses them. However, the email was sent from email.clickdimensions.com instead of cusotmers.clickdimensions.com; which may explain why the message was marked as spam. Alternatively it is possible someone else is using ClickDimensions CRM to try to masquerade as microsoft -- but the email lacks evidence saying that.

Because both the reply-to addresses and the from address are @microsoft.com, anyone operating a scam would have to work at Microsoft or have hacked someone with access to that address in order to receive replies. Microsoft commonly uses group emails at microsoft.com for support so this seems pretty normal.

It makes sense that they would want VMs with no load on them, that they are giving you for free as part of MSDN, not to be left on because you logged in to play with it and never logged back to use the VM. They probably have a lot of these "orphan" VMs and these e-mails may make it possible for them to reclaim a lot of CPU and Memory they're giving away for marketing reasons.

The question is: Are you an MSDN subscriber who has spun up an Azure instance? Is this e-mail completely out of left field or within your usage pattern?

If you do use Azure and MSDN, in the end this message is more likely than not legitimate, just poorly done by low-level likely outsourced support staff.

  • Microsoft uses a CRM (I'm not sure the exact kind) to sort incoming e-mails and assign them to tickets. In the past when I've called MS support the agent (obviously one of many) gives a shared email address, and they take your contact info. Not sure how they compute idle VMs etc, but, if you want to test this theory, you can setup a support ticket from within the Azure portal and ask them about the e-mail. – Herringbone Cat Jun 25 '16 at 23:47
1

The question you have to ask yourself is, why would ClickDimensions be sending an email and would attempt to make it look like it came from Microsoft? This is what GMail is alerting you to; the source address doesn't 100% match up.

Also, the notice is absolutely worth paying attention to, emphasis mine:

It has a from address in email-2.microsoft.com but has failed email-2.microsoft.com's tests for authentication.

GMail has done a check to see if this email really is authentic, and it's saying "no".

You're likely not being forced to click any dodgy links, but in any event, you should look not to trust this sort of email at all. Let it reside in Spam and never give it a second thought. Once they have your trust, it's pretty much game over.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy