Cybersecurity researchers have identified a new wave of phishing attacks that exploit Microsoft Sway, a cloud-based content creation tool, to host fake pages and steal Microsoft 365 credentials using QR codes. This sophisticated campaign, dubbed "quishing" (QR code phishing), underscores the growing abuse of legitimate cloud services for malicious purposes.
Exploiting Microsoft Sway for Phishing
Microsoft Sway, part of the Microsoft 365 suite since 2015, is typically used to create newsletters, presentations, and documentation. However, cybercriminals are now leveraging Sway's trusted infrastructure to host phishing pages, making the content appear legitimate to unsuspecting users. According to Netskope Threat Labs researcher Jan Michael Alcantara, attackers use this credibility to trick victims into trusting the fraudulent content.
How the Quishing Attack Works
The quishing campaigns observed primarily target users in Asia and North America, with a focus on the technology, manufacturing, and finance sectors. The attack methodology includes:
-
Hosting Phishing Pages on Microsoft Sway: Attackers create and distribute links to Sway-hosted pages containing fake QR codes. Since Sway is a legitimate Microsoft platform, victims may be more inclined to trust the link.
-
Distribution of QR Codes: The phishing pages display QR codes, which, when scanned by victims, redirect them to malicious websites designed to steal Microsoft 365 credentials. The use of QR codes makes it difficult for traditional email scanners to detect the threat, as these scanners often only analyze text-based content.
-
Adversary-in-the-Middle (AitM) Tactics: The quishing campaigns utilize AitM phishing techniques, creating lookalike login pages that capture user credentials and two-factor authentication (2FA) codes. This transparent phishing method not only steals information but also logs the victim into the service, maintaining the appearance of legitimacy.
Evasion Techniques and Sophistication
Researchers have noted a 2,000-fold increase in traffic to unique Microsoft Sway phishing pages since July 2024, highlighting the growing scale of these attacks. To evade detection, attackers have been observed using several advanced techniques:
-
Use of Cloudflare Turnstile: Some campaigns employ Cloudflare Turnstile to conceal malicious domains from static URL scanners, making it challenging for security solutions to detect the phishing sites.
-
Unicode QR Code Phishing: In a novel twist, attackers have started creating QR codes using Unicode text characters instead of traditional image-based QR codes. This approach allows the phishing codes to bypass image-scanning detection systems, as they appear as regular text. When rendered on screens, these Unicode QR codes function seamlessly as standard QR codes, adding another layer of deception.
The Challenge for Defenders
Quishing campaigns pose significant challenges for cybersecurity defenders. The use of QR codes means that victims often scan these codes with mobile devices, which may have less stringent security measures compared to laptops and desktops. This mobile vulnerability makes users more susceptible to these attacks.
Furthermore, the evolving techniques, such as using Unicode characters to create QR codes, make it harder for conventional security measures to detect and block these threats. This trend of abusing legitimate cloud services for phishing highlights the need for more robust security protocols and user awareness to combat sophisticated social engineering tactics.
Historical Context and Ongoing Threat
This isn't the first time Microsoft Sway has been exploited for phishing. In April 2020, a campaign known as "PerSwaysion" targeted high-ranking corporate officers by using Sway to redirect victims to credential harvesting sites. The recurrence of such attacks indicates that attackers continue to find value in abusing cloud-based tools to carry out phishing operations.
The rise of QR code phishing campaigns leveraging trusted cloud services like Microsoft Sway reflects the evolving threat landscape in cybersecurity. As attackers innovate and develop more sophisticated methods to bypass security defenses, organizations must stay vigilant and continuously update their security strategies to protect against these emerging threats. Enhanced monitoring of cloud-based applications and educating users on recognizing phishing attempts are critical steps in defending against such attacks.
