FlagThis

A new Microsoft 365 phishing-as-a-service platform called ‘FlowerStorm’ has emerged, filling the gap left by the shutdown of the Rockstar2FA cybercrime service. FlowerStorm is a sophisticated service which allows threat actors to create and deploy phishing campaigns specifically targeting Microsoft 365 accounts. This activity shows a clear increase in targeted phishing campaigns aimed at Microsoft users, which could lead to account compromise, data breaches and other associated risks. The sophisticated platform allows threat actors to automate much of the phishing process, increasing their efficiency and reach. This demonstrates the ease with which cybercriminals can set up and deploy complex phishing schemes.

A sophisticated phishing campaign has compromised approximately 20,000 Microsoft Azure accounts in Europe, primarily targeting manufacturing companies. The attackers used HubSpot’s Free Form Builder to create deceptive forms and DocuSign files, which were used in phishing emails to steal Microsoft Azure login credentials. This operation spanned from June to September 2024 and mainly affected firms in the automotive, chemical, and industrial sectors in Germany and the UK. The attackers aimed for long-term presence in the Azure cloud environments.

Cybercriminals are exploiting Cloudflare Pages (.dev) and Workers (.dev) for phishing and other attacks, leveraging Cloudflare’s trusted reputation. These platforms are being misused to host phishing attacks, malicious web pages, and targeted email lists. This highlights the risk of attackers misusing legitimate services for malicious purposes. The attackers are using the trusted reputation of Cloudflare to increase the success rate of their attacks.

This cluster focuses on the emergence of a new phishing-as-a-service (PhaaS) platform called ‘Rockstar 2FA’. It facilitates large-scale adversary-in-the-middle (AiTM) attacks, primarily targeting Microsoft 365 credentials. This highlights the ongoing threat of credential theft and the increasing sophistication of phishing attacks, emphasizing the importance of robust multi-factor authentication (MFA) and security awareness training.

Malicious actors are distributing malicious QR codes through various channels, including email attachments and physical mail. These QR codes lead to malicious applications designed to steal login credentials and other sensitive information. Security analysts are struggling to counter these attacks, while some email security vendors are employing overly aggressive flagging mechanisms that hinder legitimate communications.