Re: [mailop] Docusign phishing campaign of the decade, brought to you by Microsoft?

[Atro Tossavainen via mailop]

On Tue, Dec 12, 2023 at 06:22:10PM -0600, Jarland Donnell via mailop wrote:
> Hey friends,
> 
> Do me a favor and search your logs for this domain:
> SIBBERTLLC.onmicrosoft.com

Three hits yesterday.

> One customer received 1,347 attempted deliveries from it so far.
> Another, 823. Still counting, and plenty more but with smaller
> numbers. Is there no one at Microsoft watching anything, because if
> this doesn't set off red flags, there are no red flags.

I think there isn't.

This campaign wasn't particularly voluminous towards our spamtraps, we
frequently get hundreds and thousands of any given campaign (such as
the "meet Ukrainian ladies" fake dating scams that are being sent from
throwaway Hotmail accounts all the time).

-- 
Atro Tossavainen, Founder, Partner
Koli-Lõks OÜ (reg. no. 12815457, VAT ID EE101811635)
Tallinn, Estonia
tel. +372-5883-4269, https://www.koliloks.eu/
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Docusign phishing campaign of the decade, brought to you by Microsoft?

[John Levine via mailop]

It appears that Jarland Donnell via mailop  said:
>Hey friends,
>
>Do me a favor and search your logs for this domain: 
>SIBBERTLLC.onmicrosoft.com

It's not just that subdomain.  .onmicrosoft.com is free
throwaway accounts and I've seen the Docusign phish from lots
of them.

It's kind of clever, they send a real Docusign document to the onmicrosoft
address which they then configure to forward to the actual victims (us).

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] Docusign

[Udeme Ukutt via mailop]

Please if there's a Docusign contact here on the list, ping me offlist.

Udeme
Postmaster at LinkedIn
udeme at  dot com
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop