Hackers are always looking for a new angle, and recently, they've found a particularly good one.
Image recognition software is becoming increasingly sophisticated. So if hackers are interested in building a fake landing and login page designed to spoof some other company, they have to get it exactly right, including the background image, or most AV software will see through the ruse.
To get around that, some clever hackers have taken to building two different landing pages; one for the AV software and one for the user.
The page designed for the software uses the proper background image, but with the colors inverted. Image recognition software looks primarily for shapes and not for colors, so this easily fools most AV software. If a site visitor were to see that page, however, they would instantly see the flaw and become suspicious, so they're directed to a different version of the page with a proper image.
Recently, a research team attached to WMC Global had this to say about the new technique:
"Our team reviewed other campaigns deployed by this threat actor, discovering that the individual was using the same inversion technique on the newer Office 365 background."
If you're an Office 365 user, it pays to play close attention to the URL of the page you're navigating to, so you can improve your odds of avoiding inadvertently giving your login credentials to a group of hackers.
Naturally, Office 365 isn't unique in this regard. You can bet that hackers around the world are employing this trick to gain login credentials all across the internet, so vigilance is absolutely called for.
Kudos to the team at WMC Global for spotting the new trend, and make sure your IT staff is aware of the possibility so they can be on high alert and work to protect your users.
