SharePoint Fake Document Credential Phishing Attack
Initial Email Content
You've received a new SharePoint Project Document:
Project [Recipient Company Name] Building Project
Title [Recipient Company Name] Building Project Documents
Bid No. 1232-05102022
From [Recipient Name] ([Recipient Email Address])
Subject Bid Documents, Drawing, Scope of Work and Purchase Order
VIEW SHAREPOINT PROJECT DOCUMENTS
Do not hesitate to send me an email if you have any question.
Please find attached project documents to bid for the above referenced project. Review the documents, send back requested information, and provide bid proposal or quotes based on the scope of work outlined in the bid documents.
Thanks,
Thank you
Malicious Artifacts
Additional Indicators of Compromise
Type
Description
Attack Description
This link-based attack impersonates SharePoint using a self-addressed spoofed email address, a personalized subject, and a fake document theme to steal credentials.