# MA-723.052019: MyCERT Advisory - Office 365 Accounts Compromised via ATO Attacks used in BEC Scams

**Date:** 06 May 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-723.052019  
**Advisory ID:** MA-723.052019

---

**1.0 Introduction**
MyCERT is aware of the existence of Office 365 accounts that are targeted and compromised in account takeover (ATO) attacks, which cybercriminals later use the compromised accounts for various malicious activities ranging from spear-phishing, BEC attacks to malvertising campaigns.
As explained by Barracuda Networks' researchers in a report published today, more than 1.5 million malicious and spam emails were delivered by threat actors are using 4000 compromised Office 365 accounts.
Also, while analyzing ATO attacks targeting Barracuda customers, the researchers discovered that 29 percent of the monitored organizations had their Office 365 accounts infiltrated.
**2.0 Impact**
Once the Office 365 accounts were successfully hacked into, the scammers added malicious mailbox rules to hide their activity and deleted the malvertising, phishing, and spam emails sent from the account. To infiltrate their target’s accounts via ATO attacks, cybercriminals use a combination of "brand impersonation, social engineering, and phishing," impersonating high-profile companies such as Microsoft to convince potential victims to visit previously set up phishing landing pages and send over their accounts credentials.
The stolen credentials for personal emails we later used to gain access to the compromised Office 365 accounts and to try get access to business email as part of BEC (Business Email Compromise) or EAC (Email Account Compromise) campaigns. Brute-force attacks were also observed by the researchers, an attack method which takes advantage of the fact that users set up very easy to guess passwords.
**3.0 Affected Product**
• Microsoft Office 365
**4.0 Recommendations**
• Users are advised to be extra cautious of phishing emails
• Double check the links to make sure that it is match with the legitimate resources for the organization
• For best practices regarding phishing emails, kindly refer to this URL: [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=e45ff529-db9f-42a4-be96-b059c63dcba3](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=e45ff529-db9f-42a4-be96-b059c63dcba3
)
**5.0 Reference**
• <https://www.bleepingcomputer.com/news/security/office-365-accounts-compromised-via-ato-attacks-used-in-bec-scams/>
• <https://docs.microsoft.com/en-us/office365/securitycompliance/responding-to-a-compromised-email-account>
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#61021803041358585821021803041312040214130815184f0c18) or [[email protected]](/cdn-cgi/l/email-protection#b3decad0d6c1c7f3decad0d6c1c79ddcc1d49ddeca)
Phone: 1-300-88-2999 (monitored during business hours)
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 08:30 AM - 17:30 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://www.mycert.org.my/portal/advisory?id=MA-720.042019) or [Android Users](https://www.mycert.org.my/portal/advisory?id=MA-720.042019)