1

One of my colleagues received a phishing email in which he clicked on a link. The domain (www.phishing-link.biz) redirected to adfx.xxx.edu which does look like adfs authentication page.

Colleague restated that he did not provide his user name and credentials but closed the window immediately. But after several hours later his account got compromised and huge amount of spam emails were flowing out.

Without providing any information, is there any way the hackers get the info (like session hijacking). From host level, how can we see that the user has not provided credentials. Is there any tool which can assist me in getting info?

Tom K.
  • 7,913
  • 3
  • 30
  • 53
MS Guy
  • 97
  • 9
  • Is your domain controller logging any login details? If so where are they from? OWA / their computer? Did changing their password have any effect? – DKNUCKLES Jan 22 '18 at 14:09

1 Answers1

3

I see that the site is now suspended by hostmonster. Assuming he did not provide credentials knowingly or unknowingly, here are a few possiblities, if the phishing email was linked to the account compromised at all.

1. Clipboard content stolen

The malicious page could have stolen clipboard data.

2. Malicious scripts

The malicious link redirects user to an edu page, but in between the redirection could be many other redirected pages. I've seen a few good examples going through different server-side php pages (apart from client side code from above example) and it's transparent to the naked eye. Scripts could send out emails without email client dialog boxes.

Malware could have been downloaded as well, that may have compromised the machine to be an open relay server.

3. Malicious plugin/extension installed

In basic authentication, credentials are sent via HTTP POST, which is accessible via browser developer tools. A malicious plugin can exploit that.

With that said, it is useful to understand how the spam emails were sent out, be it through web mail (so we know it's about web security) or client-based (so we know it's host and network security related). Each track would have more possibilities of their own.

In terms of tools that can help you, why don't you check on outbound data to the malicious host, if you have the logs - proxy logs, netflow, packet capture etc. Those would paint a good picture on what was ex-filtrated.

George
  • 739
  • 1
  • 6
  • 22