Z-CERT is warning of an active phishing campaign that appears to be spreading through the healthcare sector. Several healthcare organisations have already been affected. The expertise centre is still investigating the campaign and says it is too early to draw conclusions about its scale, impact and the organisations potentially affected.
Attackers send a phishing email containing a link to a Microsoft Forms form. Users are then asked to click several times to open a secure document. In the final step, they must enter a verification code on an official Microsoft page.
Anyone who enters the code gives the attacker access to their Microsoft account. According to Z-CERT, this enables attackers to bypass measures such as multi-factor authentication and security rules, because the user performs the actions within the legitimate Microsoft environment. New phishing emails are sent from compromised accounts, making the messages appear to come from known senders and allowing the campaign to spread further.
Z-CERT advises users never to enter a number or letter code unexpectedly on a Microsoft page when prompted to do so by email or another message. Administrators are advised to disable or restrict device code flow within the Microsoft environment.
