Phishers trick Microsoft into granting them ‘verified’ Cloud Partner status

Late last year, a group of threat actors managed to obtain “verified publisher” status through the Microsoft Cloud Partner Program (MCPP). This allowed them to surpass levels of brand impersonation ordinarily seen in phishing campaigns, as they distributed malicious applications bolstered by a verified blue badge only ever given to trusted vendors and service providers in the Microsoft ecosystem.

The MCPP is Microsoft’s channel partner program, inhabited by 400,000-plus companies that sell and support its enterprise products and services and also build their own solutions and software around them. Members include managed services providers, independent software vendors, and business app developers, among others.

Researchers from Proofpoint first discovered this activity on Dec. 6 of last year. A report published on Jan. 31 outlines how threat actors used their bogus status as verified app publishers within the MCPP program to infiltrate UK- and Ireland-based organizations’ cloud environments. The fake solutions partners targeted employees in finance and marketing, as well as managers and executives, via malicious applications. Users who fell for the badge potentially exposed themselves to account takeover, data exfiltration, and business email compromise (BEC), and their organizations were laid open to brand impersonation.

Overall, the campaign “used unprecedented sophistication to bypass Microsoft’s security mechanisms,” the researchers tell Dark Reading. “This was an extremely well-thought-out operation.”

How the Hackers Duped Microsoft

To become a verified publisher, Microsoft Cloud Partners must meet a set of eight criteria. These criteria are largely technical and, as Microsoft outlined in its documentation, passing the bar “doesn’t imply or indicate quality criteria you might look for in an app.” But threat actors abusing the system to distribute malicious apps? That’s not supposed to happen.

The trick in this case was that, before phishing end users, the attackers tricked Microsoft itself.

To wit: They registered as publishers under “displayed” names that mimicked legitimate companies. Meanwhile, their associated “verified publisher” names were hidden and slightly different. The example given by the researchers is that a publisher masquerading as “Acme LLC” might have a verified publisher name “Acme Holdings LLC.”

Evidently, this was enough to skate by the systems’ verification process. In fact, researchers noted, “in two cases, the verification was granted one day after the creation of the malicious application.”

When reached for comment on the failure of the verification process, Proofpoint did not offer further details, and a Microsoft spokesperson merely noted, “Consent phishing is an ongoing, industrywide issue, and we’re continuously monitoring for new attack patterns. We’ve disabled these malicious apps and are taking additional steps to harden our services to help keep customers secure.”

The spokesperson added, “The limited number of customers who were impacted by the campaign described in the Proofpoint blog have been notified.”

How the Hackers Duped Enterprise Users

Having obtained their verified status, the threat actors began spreading malicious OAuth apps, an increasingly popular vehicle for cyberattackers in recent years. They rigged these apps to request broad access to victims’ accounts.

To read the complete article, visit Dark Reading.