Analyzing Account Takeover Attacks Leveraging SquarePhish2 and Graphish

Several state-sponsored and financially motivated attacks enabled by SquarePhish2 and Graphish, among other phishing tools, tricked users into granting threat actors access to their Microsoft 365 accounts. The consequences included account takeover, data exfiltration, and others.

Proofpoint identified several IoCs¹ associated with the attacks. After a closer look at the original IoC list, we analyzed 46 IoCs in all comprising 21 subdomains (including four with multiple variations), 22 domains, one IP address, and two email addresses.

Using our homegrown tools to investigate the threat, we uncovered these findings:

• Five domains identified as IoCs were deemed likely to turn malicious 65–93 days before being dubbed as such
• 91 email-connected domains
• 23 additional IP addresses, 22 of which turned out to be malicious
• Two IP-connected domains
• 15 string-connected domains
• Two string-connected subdomains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover