Connect with us

Hi, what are you looking for?


Office 365 phishing attack impersonates the US Department of Labor

USA flag


A new phishing campaign impersonating the United States Department of Labor asks recipients to submit bids to steal Office 365 credentials.

The phishing campaign has been ongoing for at least a couple of months and utilizes over ten different phishing sites impersonating the government agency.

Spoofed addresses and server abuse

In a new report by email security firm INKY, who shared the report with Bleeping Computer before publication, researchers illustrated how the phishing attack is used to steal credentials.

The emails are sent from spoofed domains that look as if they came from the actual Department of Labor (DoL) site, while some are based on a set of newly created look-alike domains such as:

  • dol-gov[.]with
  • dol-gov[.]us
  • bids-dolgov[.]us

Most of the emails pass through abused servers owned by non-profit organizations to evade email security blocks.

email headers reflecting the bouncing
Email headers reflecting the bouncing
Source: INKY

In other cases, they are sent through newly registered and unreported domains that aren’t yet included on anti-phishing lists.

The sender pretends to be a senior DoL employee who invites the recipient to submit their bid for an ongoing government project.

Email sample used in the campaign
Sample of the email used in the campaign
Source: INKY

The emails contain a valid letterhead, professionally-arranged content, and a three-page PDF attachment of a seemingly legitimate form.

The button that leads to the phishing site
The button that leads to the phishing site
Source: INKY

The PDF contains a “BID” button, which, if clicked, takes the victim to one of the phishing sites. INKY has confirmed the following landing pages as part of this campaign:

  • opendolbid[.]us
  • usdol-gov[.]with
  • bid-dolgov[.]us
  • us-dolbids[.]us
  • dol-bids[.]us
  • openbids-dolgov[.]us
  • open-biddolgov[.]us
  • openbids-dolgov[.]with
  • usdol-gov[.]us
  • dolbids[.]with
  • openbid-dolgov[.]us
  • arr[.]global

The spoofed site looks convincing, containing identical HTML and CSS to the real one. The threat actors have even included an instructions pop-up message to direct victims through the bidding (phishing) process.

Instructions message on one of the phishing sites
Instructions message on one of the phishing sites
Source: INKY

Those who bid for a project will be taken to a credential harvesting form that targets their Microsoft Office 365 email address and password.

Stealing victim's credentials
Stealing Microsoft Office 365 credentials
Source: INKY

No matter what’s inputted there, the website returns a bogus error to trick the victim into entering them again, thus reducing the chances of stealing mistyped credentials.

If the victim falls for the trap for a second time, they are eventually re-directed to the actual DoL site, left with little evidence as to what exactly has happened.

Similar campaigns on the rise

This campaign’s level of sophistication and diligence in setting up convincing web pages and writing error-free phishing emails is worrying.

Advertisement. Scroll to continue reading.

We saw something similar in December 2021, with phishing actors impersonating Pfizer and using well-crafted PDF attachments to invite recipients to submit bids to the pharmaceutical company.

In this case, the actors take things one step further by abusing legitimate mail servers to send their phishing lures.

Unfortunately, all that leaves email recipients with is very subtle evidence of the trickery targeting them, so ultimate vigilance is advised.

In this case, the most obvious sign of the scam would be the Department of Labor requiring anyone to log in with Office 365 credentials to view a document, something that isn’t the case on any U.S. government website.

Source link

Click to comment

Leave a Reply



Interested in learning what’s next for the gaming industry? Join gaming executives to discuss emerging parts of the industry this October at GamesBeat Summit...

Loan And Finance

Live music has well and truly returned from its forced pandemic pause. While thousands spent the past weekend (June 24-26) in the Glastonbury fields...

Online Business Success

By Vishal Bharucha, President of VNB Business Brokers, a leading Business Brokerage and M&A Advisory firm. getty The manufacturing industry is known for its...


Interested in learning what’s next for the gaming industry? Join gaming executives to discuss emerging parts of the industry this October at GamesBeat Summit...

Top Stories

North Korea leads the world in crypto crime, with over 15 documented instances of cyber theft amounting to $1.59 billion in stolen funds. However,...

Online Business Success

Founder & CEO of Sawyer & Company, a SoHo, New York-based boutique design studio. getty As remote work becomes increasingly more prevalent, employers are...


You May Also Like


Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...