Cybercriminals are using Microsoft Sway to host landing pages used in phishing campaigns, experts have claimed.

The attack was spotted by cybersecurity researchers from Netskope Threat Labs, who observed a 2,000-fold increase in exploits in July 2024.

You can be excused for not knowing what Sway is. It is a niche Microsoft product, a cloud-based presentation and storytelling tool that people can use to create interactive reports, presentations, newsletters, and other similar content. It’s part of the Microsoft Office suite and can be accessed through the browser.

Transparent phishing

Netskope found unnamed threat actors used Sway to create presentations that held a QR code. This code redirected the victims to a phishing landing page that looks like a Microsoft 365 login site. Those that fall for the ruse end up giving away their login credentials.

This is not the first time hackers were observed using QR codes in phishing attacks. Since a QR code is usually an image file (.JPG), it cannot be scanned by antivirus tools and can thus bypass different email protection services. Furthermore, a QR code is usually read through a smartphone (since it’s easier to point the phone’s camera instead of the laptop) which, generally, have weaker protections compared to computers. Cybercriminals have been using QR codes for years now.

However, this campaign also employs something called “transparent phishing”. This is a method where the victim is actually logged into the legitimate site, while at the same time, relaying the stolen credentials (MFA codes included) to the crooks.

The victims are mostly located in Asia and North America, and work in technology, manufacturing, and finance industries.

Cybercriminals are constantly evolving their phishing tactics, but the defense strategy remains the same - be vigilant and skeptical of any incoming email messages, especially those that carry a sense of urgency.

Via BleepingComputer

More from TechRadar Pro