1

So this week was kind of brutal with an increase in phishing attempts for my users on Office/Microsoft 365.

Two people clicked on links but didn’t proceed after that…one thing I did notice was that the “Phish” link started with mail.spiceworks.com .

https://mail.spiceworks.com/78Z3-7SNI-28Z311-77GGY-1/c.aspx?_externalContentRedirect=https://tesseractfitness.sg/new/auth/bs5i43/ZGFycmluQHBpbm5hY2xlc3RydWN0dXJlcy5jb20=

And in this case, if you click on it, it sends you to that users O365 login page.

Any clue why this would bounce from Spiceworks?

7 Spice ups
2

Did the email come via sendgrid? If you hover over the link in the email it should show you where it came from - clicked links are trackable, so they will now know who clicked the link.

If so they’re likely spoofing systems you know - by the way, that link also contains the users email and domain.

@spiceworks-support-team ​ is this something you are aware of?

1 Spice up
3

Hi，

If these messages are not from senders that you trust, I recommend that you submit the message to Microsoft for analysis to confirm that the message is safe.

Report spam, non-spam, phishing, suspicious emails and files to Microsoft | Microsoft Learn

4

I do have most users “trained” to do REPORT PHISHING but due to the increase lately, I am going to have to open a case with them…

It also gets frustrating when these emails “pass” everything…

991da975-c4a1-46a3-a59c-cbd7aa9b5fb3-spam_01.jpg

5

Perhaps you can set up mail flow rules to reject such messages.

6

Malicious open redirects can be difficult to detect. It would be interesting if Spiceworks.com allows the open redirect stated above (i.e., _externalContentRedirect=https://). If this is the case, Spiceworks needs to close the open redirect. But either way, make sure to educate your end-users about malicious open redirects (coincidentally, I’ll be posting an article on them in just a few minutes, as an example). The ultimate defense is users must always look at the destination URL where they arrive after clicking on a link and determine if that link is legitimate or rogue. It’s one of the only ways to fight malicious open redirects.

2 Spice ups
7

So I called Microsoft and they had me update my DMARC records and so far, at the moment, the phishing emails have slowed down.

8

I’m glad you’re getting somewhere, but your initial post suggested nothing about your domains SPF, DKIM or DMARC records otherwise that would have been my first reply.

Glad you’ve got support though.

1 Spice up
9

So, I bring this post up again because lately and especially today, the phishing emails have gotten worse and as far as I know, all of my SPF, DKIM or DMARC settings are right and I don’t think a call to Microsoft will help. But it is getting frustrating.