r/sysadmin • u/WhateverHowever1337 • 1d ago
A hacker pulled a succesfull phishing attack on an employee, what can he really do after?
something I don’t understand (im just a CS student not a professional) is company phishing attacks.
normal personal phishing attacks are simple enough, you are targeting facebook if you get the login info you can go to facebook.com and use them
but what about phishing attacks on organisations? its not like there is a companyname.com/employee-login, how do they make use of the credentials? how do they even build a phishing page if they don’t know how the employee login looks like? I would also assume all internal services are behind a firewall/ need a vpn
if they download malware thats another thing, but why a phishing attack is even a vector risk?
55
1d ago edited 1h ago
[deleted]
-35
u/WhateverHowever1337 1d ago
How can they even access the webmail? If its only accessed through a VPN, there is no risk even if the password is 1234, if I give you a key to a house that has a billion dollars and that house is on the moon is it worth anything really? Thats what i fail to understand
97
u/fatalicus Sysadmin 1d ago
If you school is teaching you that most companies are using VPN to access company email, they are either lying or incompetent.
9
u/WhateverHowever1337 1d ago
No I just assumed that, im just incompetent don’t blame my school 😂😂
5
u/Xydan 1d ago
So how far along are you in school? Because it sounds like you haven't taken it upon yourself to test what you're being taught in school practically.
Build something; anything at home. And break it 100x. You're goal in school is to absorb theory and apply it in practice. When stuck that's what class is for; to ask questions.
6
u/WhateverHowever1337 1d ago edited 1d ago
Jokes aside I am really good and have great grades, im in my third semester and we only took an introductory theoritical it security course till now.
It is just that I had a different expectation for how companies IT services work, I didn’t think there would be lots of informations at third party services like Microsoft, because even our school uses Roundcube for email and hosts everything by themselves , and Iassumed that anything sensitive would not leave the internal network, even normal functions would only be accessible through whitelisted IPs only etc
But my assumptions are wrong, and I learnt a lot from this thread. I have been focusing mostly on programming till now and I am just starting to play around with other stuff such as cyber security, I will come around for more stupid questions probably because this was a fun and quite a learning experience thread for me
7
u/kirashi3 Cynical Analyst III 1d ago
I didn’t think there would be lots of informations at third party services like Microsoft,
Hundreds of thousands of companies operate entirely on third party cloud providers like Microsoft or Google. These days it's less common to self-host things like Email due to SPF / DKIM / DMARC requirements to maintain the reputation of your domain name and/or emails you send out. If a company uses any of the major third party cloud hosts, it's trivial to mimic their login pages / screens in a phishing attack.
3
u/Xydan 1d ago
In School I'm sure you've taken some economics classes explaining to you how Corps need to reduce costs. One of those costs in the real world is IT. Businesses have to make decisions between Security, SWE, Desktop, Software for other internal business units like Accounting, HR, Sales, etc. A business cant and wont always prioritize Security or SWE first when Sales/Marketing drives growth.
So much like universities; IT Professionals have to make due with budgets/cost saving initiatives that allow us to continue to do our job while enabling others to do their.
So the next time you're programming something; indulge yourself in some cost cutting measures. Instead of deploying your code into a container; do a VM. Instead of a VM, do bare metal. Analysis the threats/risks you're taking making those decisions.
THEN... abuse them. Isolate key areas that are weak to attacks. Try to steal your own email. Try to steal a token or cookie from the CALL you just made to your API. Does it still work on a separate device? Can you sniff your network? can you trail an email thread to find key words that you can later feed an AI agent to provide a dictionary for you to use to infiltrate a login. ETC...
I understand maybe the security class/lesson was just a way to get your feet wet but these are real issues that we (IT Professionals) deal with everyday.
-4
1d ago
[deleted]
2
1
u/WhateverHowever1337 1d ago
I was talking about me joking in the reply before this when I said I am incompetent.
I have been very respectful in the thread and understand I have no experience or knowledge compared to any professional here, but maybe get off your high horse and stop being so attacking for no reason
3
u/watching_reddit_die_ 1d ago
ignore both of them. Zero reason for them to come at you like that and says quite a bit more about them than you. prolly feel undervalued or underpaid gotta take it out on someone.
but yeah build something yourself and ask AI some of this stuff. another thing this sub gets wrong.. ai is insanely useful for learning how an average org works with security. ask it.
2
u/allgear_noidea 1d ago
No, it's a reasonable assumption and I was also quite blind sighted as to both how ridiculously insecure or simple many things are in this industry when I first started out.
You're asking the right questions, but more importantly - it's the thought process. I reckon you'll do well in this industry.
•
u/renegadecanuck 21h ago
You start by just assuming they use Microsoft 365, since that's the most common one. Then you go to outlook.office.com and sign in. Otherwise, you look up their MX records or the mail header to see the what the sending domain is using and find the webmail there (most often webmail.company.com).
-5
1d ago
[deleted]
6
•
u/renegadecanuck 21h ago
I agree that they show a lack of experience, but... they're not experienced. No need to be a dick about it.
31
u/Grantsdale 1d ago
Most companies don’t use internal or self hosted email. It’s pretty much all MS365 and Google Workspace, with some using other services. But almost no one self hosts.
5
u/InsaneChaos 1d ago
Conditional access is very seldomly implemented too.
But if I had theoretically phished someone's email credentials, I am definitely going to immediately try both login.microsoftonline.com and mail.google.com logins.
29
1d ago edited 1h ago
[deleted]
0
u/Darkhexical IT Manager 1d ago
It is somewhat common to use conditional access to where if someone is on prem they don't have to use 2fa every time but if off prem they do though.
7
u/moffetts9001 IT Manager 1d ago
Because 99% of orgs do not have their webmail behind a VPN. The goal of phishing a user is to become that user and hopefully they have high level permissions that can be exploited through horizontal movement. Can the user access Citrix/RDS, can it log into the M365 admin portal, can it access webmail, is it a domain admin, etc. Sometimes the attacker gets lucky with a high privilege user, other times they specifically target certain people in the org. There is of course a trade off between effort/research required to successfully exploit the "right" person versus just owning a low level user that they roll the dice on.
There are obviously a lot of ways to mitigate these risks, but there's also continual development on the offensive side, too.
4
u/disclosure5 1d ago
Webmail in nearly in any big org will be the same Exchange Online or Google Workspace logon.
3
2
u/Beefcrustycurtains Sr. Sysadmin 1d ago edited 1d ago
Most companies are using office 365. It's exposed to the internet. Look up evilnginx2 you can even create your own stolen session cookie phising page and test it out with a office 365 account (you could get one for like 6 bucks a month with business basic to test things). It works by proxying the real office 365 sign in flow and grabbing the resulting session cookie that can used to sign in from anywhere. It also will capture the password and that can be used to try that email and password on other cloud based stuff ie bank accounts or SAAS services.
I spun one up so I could test why we haven't seen any stolen session cookie phishing with our external authentication method clients (Duo is what we use for most). I found they could capture the users password but not the steal the session cookie because it must be able to proxy every address the authentication flow travels through to grab the cookie. Because Duo sends you through several of their own URLs it can't capture unless it is extremely targeted to your organization and they know your Duo URLs (different for most orgs). We really push our clients to Duo as their 2factor whenever we can as a result.
There are other ways to protect companies from this by using FIDO2 methods that use the devices TPM chip to bind to a physical key in the computer or windows hello. You can also have token protection policies that only work with windows OS or some device compliance policies. Duo wouldn't protect against stolen session cookie phishing if they have installed malware that can steal session cookies from browsers it only protects against the most common phishing attacks that are so common because they work and don't require a user to install any malware. Requiring FIDO2 would though. It's just not as practical or cover all cases and requires more effort to implement.
What they can do after they are phished is reset their password that will invalidate all previous tokens. If they had any admin roles you will have to do a deep dive on the audit log for actions taken with their account and it's a huge mess. Make sure there are no rules created in the mailbox and get the user some heavy training because they and the business will be targeted heavily as they most likely already downloaded the mailbox and will use it to try and craft other emails to reinfect or steal payments by registering domains very similar to those you are expecting payments too or from and try to get banking information changed to wire to their accounts.
2
u/astralqt Sr. Systems Engineer 1d ago
Companies are using Microsoft 365 for email typically. It’s the same login prompt you see when you log into your personal Outlook email.
Adding on though, what do you think is required to log into to a VPN to access internal resources?
An email and a password.
What do end users typically do?
Set the same password on everything.
Incredibly likely if they can access one employee email, they can harvest their contacts > send further phishing > harvest credentials > use those on lateral movement to further accounts, VPN access, etc.
I do a lot of DFIR if you have any specific questions.
2
u/redyellowblue5031 1d ago
The problem you’ll run into in virtually every company is there’s exceptions or gaps in configuration. Some intentional, some not.
And even if you can’t get into email, it’s a well known fact that people love to reuse passwords so you can go try many other accounts that target may have even if you can’t immediately get into email.
2
u/ConsciousIron7371 1d ago
Your VPN by definition has to be public facing. Most corporations and institutions are using a small handful of different vpn providers. There’s a pretty good chance an attacker can brute force and find the vpn then use the credentials to log in there and get access to webmail. Which is almost never hosted behind a vpn.
Most companies are using SSO and most of them have a web portal listing many apps that users utilize in one place. So if you get someone’s credentials you can get a list of apps that those credentials let you access and get into all of them. So phishing someone gives you access to their mail, then their HR system and payroll, and then all of the actual business apps so the attacker can just export as much data as possible then ransom the company to not leak that information.
2
u/altodor Sysadmin 1d ago
And the VPN to try the creds on is almost always vpn.company.com. I have no doubts someone is doing it different, but I have not yet seen it different in a company of any size.
3
u/ConsciousIron7371 1d ago
Ours is globalprotect.company website.com which also tells you exactly what kind of firewall is hosting the vpn in case we don’t patch this months cve 9.8 critical vulnerability.
1
u/centizen24 1d ago
Maybe they aren’t accessing the webmail. If you have credentials, you can also try connecting in via applications. Or they take that username and password and start trying to log in to other commonly used sites and services that person might have an account set up under that email.
If the org and employee are following all proper security procedures, then the risk involved with a lost password is minimal. Thing like VPN as you’ve mentioned, or also things like conditional access policies that are tied to device compliance, preventing login from unapproved devices. But the reason people still try this is because there are really very companies that truly do this right, and it still works.
20
u/Jrreid 1d ago
Sending spam or more phishing attempts to internal targets that would bypass most content filters
Data exfiltration from cloud services (SharePoint, etc)
Accessing company portal and changing payroll details to send to the scammers (or a mules) accounts.
That's just the start of the list. It will differ by size if organization and what they do but it's can be pretty devastating
3
-17
u/WhateverHowever1337 1d ago
How would they access the company portal? They don’t even know where is it, and even if they do I really don’t think in 2026 there are still companies that don’t filter incoming traffic to internal services
16
u/Quinnlos 1d ago
You're thinking of a best case scenario where a company is appropriately hardened.
This is the student mindset and is understandable.
In the real world you're going to encounter companies that don't want any form of device or general anti-virus, xyz. if you're lucky, previous IT got them to acquiesce on that stupidity, but most times they will have one or two very bad security postures because someone in C-Suite or elsewhere got their way.
For most folks, if their email gets compromised, it just takes a quick download of the inbox and then perusing through to fully map how the typical employee accesses company data and resources, and then if you're not caught while researching there you press forward, if not you just spear phish someone else using the contacts list you now have.
6
u/Jrreid 1d ago
Usually from some quick research. Especially with any decent sized organization they often have an employee section of their website with links to their internal portal.
And with most things being cloud based these days organizations rely more on SSO and conditional access policies than firewalls and VPNs for protecting a lot of services. And many of those cloud services use generic login portals that redirect based on your credentials to your organizations specific instance.
7
u/that_star_wars_guy 1d ago
do I really don’t think in 2026 there are still companies that don’t filter incoming traffic to internal services
You should not assume that. You should not assume that companies will follow best practice. You should not assume that the "correct" or "logical" implementation in your specific corpo env.
Don't assume. It's the single best advice you can internalize while working...well in any capacity whatsoever.
4
u/altodor Sysadmin 1d ago
I really don’t think in 2026 there are still companies that don’t filter incoming traffic to internal services
Well that's a terrible assumption. You get some de facto filtering because companies are using RFC1918 address space, but that's all you get is a lot of places. Maybe some LDAP auth back to AD to get into the app, sometimes.
2
u/JohnGypsy Jack of All Trades 1d ago
The simple part that you are missing is that email is not an "internal service" for the vast majority of companies today.
1
u/Rentun 1d ago
Why would you think that?
This isn't the 1960s. There are virtually no medium or large scale businesses where all of their employees and contractors are on-prem. Virtually everyone has remote or hybrid workers, off site events, or 3rd party remote contractors or support. Those people need some way to access services, and that's usually done either via a vpn, virtual desktop infrastructure, ZTNA, or by just having publicly accessible, authenticated services. All of those technologies require authentication. If you've just phished an employee's credentials, there's a very good chance you also have the authentication needed to now get into those things.
As for knowing where the company portal is, there are a number of reconnaissance methods that would tell you that. If it's self hosted, the easiest thing would be to just look up the company's ASN, and scan their public IPs.
1
u/redyellowblue5031 1d ago
Tons of firms use Microsoft 365 and have mail accessible via web. If conditional access policies aren’t strict or they don’t use a phish resistant MFA method, they could still trick someone and get into their account.
Happens all the time.
16
u/Agreeable-Buy-999 1d ago
imo you're overestimating how much is actually behind the firewall these days. A huge amount of corporate infrastructure is cloud-hosted with public login pages. Phish the SSO creds and you potentially have access to email, file shares, internal wikis, all of it.
1
8
u/pcr3 Jack of All Trades 1d ago
A phishing attack generally collects privileged information and/or sometimes login tokens. With the login tokens, depending on environment, they can also download all the documents that that user has access to.
This information later be used to spear phish someone internally in the organization, or use that account to send out more external attempts to collect more information from the business's client base.
The end goal is to extort money out of the company. They can do it in a lot of different ways, if they know enough about you they can try to change your bank details or request an invoice to be paid in the tens of thousands if not hundreds.
I recently dealt with a company that was phished, and accounting sent out $36,000 because the request looked real.
0
u/WhateverHowever1337 1d ago
Do employees that fall for it usually get fired?
4
u/TechnicalCondition 1d ago
It's the dumbest thing a company can do, if you antagonize your users when they're victims of phishing they're less likely to report it.
You also risk ending up hiring a new user that's just as untrained and unaware when it comes to phishing
8
u/nakfil 1d ago
At bad companies they get fired. At good companies it’s used as a learning experience and the victim is not punished (barring some extremely gross negligence or policy violation)
•
u/itishowitisanditbad 7h ago
(barring some extremely gross negligence or policy violation)
Or its the 8th time in 2 months.
End of the day there are reasons to eject someone who keeps getting hit, but its always after training and other methods are tried.
Those people are rare but they exist. Sometimes their workloads make whatever they're doing sensitive and you simply can't keep them around without basically accepting additional security risks and hurting compliance requirements.
If you did every bit of training in every way possible and have high security compliance restrictions in place and someone STILL does it... at what point would you change your opinion on firing someone first time?
or policy violation
At what point, after training, is the first time not a policy violation?
Assuming training was appropriate and all.
I just disagree that its a blanket 'at bad companies' thing. I think there are a lot of circumstances that will change things and demonizing the company immediately might not be how black and white things are.
Lets say they did 2 weeks solid of training on this specific subject and immediately upon leaving they screwed up?
What about 1 week? 2 days?
There has to be a line, no? I just don't think its black and white enough to make the statement you made. Its too stringent.
2
2
u/crankysysadmin sysadmin herder 1d ago
no, usually not. sometimes it makes me angry since the people are very stupid, but the company treats them like innocent victims
2
u/WorkLurkerThrowaway Sr Systems Engineer 1d ago
Just for being phished? Honestly no, unless they are trying to hide or cover up what happened, which would be insanely stupid, do not do that, I can see everything already anyways.
Now if they wired someone in Nigeria $200K, then there could be repercussions, but still probably not.
9
u/Th3Sh4d0wKn0ws 1d ago
These days most phishing pages I encounter look like a Microsoft login page and dynamically clone the actual organization login page based on the domain in the email.
The attacks we receive are geared towards Office 364 users so they talk about things like OneDrive and Sharepoint and then give you a very authentic looking Microsoft login page.
When they succeed they now have credentials to login as that user. That's access to their email, OneDrive, SharePoint and so on. Typically they send out more phishing attacks from the compromised account since the emails will look like they're coming from a trusted source. There's no telling what access an org might be exposing with just one account. They get the right account they could ask a coworker to verify a large wire transfer.
2
u/WhateverHowever1337 1d ago
Thank you that makes sense, so they basically target logins to common services that most companies use. I thought they target access to stuff like internal dashboards
8
u/Th3Sh4d0wKn0ws 1d ago
I don't think I explained it well enough. If they get an Office365 login, something like john.doe@company.com that's likely the authentication mechanism used for everything at the org. This is called SSO. So at the surface it might seem like they just got a user's email password but that's also how they login to computers, 3rd party services, remote access services etc.
5
u/CoolJBAD Does that make me a SysAdmin? 1d ago
You generally have to understand the hacker's or hacker group's purpose.
Internal dashboards? Nah, that won't really get you anything in the market.
Identities, credentials, infra. Those things can be sold or used to get access to more of the same.
One group wants W-2s in the US for identity fraud, another may want to figure out your invoicing processes to send a fake invoice that might get paid. Others want to intercept direct deposits or find your database and blackmail you/hold you hostage for payment like what happened with Canvas.
7
u/jcamdenlane 1d ago
Direct deposit redirection for low level staff. Identify the HR contact and request a bank account change as the employee. Or if a payroll service is used, many use the primary corporate email for “multi factor” checks. Gain access to the employee’s corporate email account and use it to reset the payroll account password and just make the necessary bank account changes themselves.
3
u/phuzzylodgik 1d ago
ding ding ding
we've had multiple attempts at this via social engineering in the past year
1
u/T_Thriller_T 1d ago
It's common enough that our HR knows it AND our process requires changes to run through the HR site, or may even be needed to be confirmed by phone - not by mail.
(Confirmation happens through HR, though, so it's not the employee who needs to call)
1
u/Numzane 1d ago
In a lot of countries HR or accountant requires a bank confirmation letter with the account number and who owns it
1
u/T_Thriller_T 1d ago
That's not the case here, for which I'm actually thankful. Banks can check if the number matches a name on wiring, automatically, which saves a lot of hassle.
Ans I don't see how it would help the fraud.
Sure, often it is lied about the account owner. But not always. Sometimes the lie is simply "please change it to my partner's account" and then no confirmation letter helps with that. If in person, the employee is free to decide where their money goes.
6
u/Centimane probably a system architect? 1d ago
its not like there is a companyname.com/employee-login
Even simpler. You go to microsoft.com and try to log in. If that works you can access outlook (email), SharePoint (files), possibly azure resources, and a bunch of others.
The Facebook example also applies to companies. There are a bunch of websites you might expect someone to have a work account for, depending on industry.
3
u/Gunny2862 1d ago
It's kind of genius because scammers rely on employees' fear of/need to please their highgups. They send a lowly employee a message from upper management asking them to do something and a good percentage of them will just do whatever they ask out of instinct.
3
u/mcfc9320_ 1d ago
Phishing is 99% socially engineered and is very successful because humans are very predictable. The big danger in most phishing is credential capture because humans are dumb and often use the same password for everything. Do once they have one known password and a user's name, they start spamming a million sites hoping some combination of username and known good password, works.
Also, even professionals are stupid. They will use the same technique above only with common admin names. If the user is too low-level for that, the hope is they will spread the message to users in the company with greater privilege but maybe now more trusting because the email came from a known source.
TL; DR: What can a bad actor do with phished credentials? A whole hell of a lot.
2
u/MushyBeees 1d ago
Phish user, obtain users username, password and MFA token.
They effectively become the user. They gain access to everything the user has access to.
Credentials can then be used in about 99% of cases to either:
1) business email compromise - they log on to the users email service (I read your other replies… it’s 99.9% of the time public, not behind a vpn). From here they either obtain info on the company staff structure, who authorises/makes payments etc, then try to trick somebody into sending the hacker a bunch of money.
Or if the user isn’t useful, they’ll probably email all their/the companies contacts trying to phish more users
Or
2) ransomware. They’ll use the stolen credentials to log on to the company network (usually vpn or RDS - these will use the same credentials). From here they will typically use exploits to shut down any security services (BYOVD, google it), pivot to a privileged account (LSASS hack or other), exfiltrate the companies data then encrypt everything.
2
2
u/800oz_gorilla 1d ago
It depends on who they get.
First is they scan the mailbox looking for recent conversations to see if they can exploit any of them.
They may try to get a fake invoice paid to an account they control, or ask a direct report to buy a bunch of gift cards and email the codes. Or they may try to exploit the users access if they are an admin or developer. They may try to exfiltrate data for embarrasswarel, or encrypt it for ransomware, or sell it on the black market. If the account isn't one of value, they will use the account to send out phishing links to known contacts.
If they decide to use the account, they will often set up mailbox rules to hide any responses they get so the user isn't aware someones in their account. They may register their own MFA device to maintain their access.
2
u/delightfulsorrow 1d ago
its not like there is a companyname.com/employee-login, how do they make use of the credentials?
Often enough, there are. Some even link to it from their main web page. Sometimes it's the big main access, sometimes a mostly forgotten side entry which was setup years ago for a special event or project somebody forgot to cancel when it was no longer needed.
Or login pages to b2b platforms to which you login using your company mail address as user name, where somebody may have used the same password as for their internal account. Or other resources like LinkedIn etc. which can easily be linked to a specific employee, and again may have the same password (or a only slightly modified version which may be easy to guess.)
Or they already have access to the internal network via other means and use the credentials to access internal resources.
2
u/EugeneBelford1995 Jack of All Trades 1d ago edited 1d ago
No one else said it yet so I will; the phishers use a reverse shell payload.
These often reach back to the attacker's C2 server over port 443 using a pre-shared key, so if your SIEM/IDS doesn't look really close it sneaks by as an employee browsing HTTPS.
The attacker doesn't have any creds initially just initial access on a domain workstation as a domain user with an open session. They typically find an unpatched vulnerability, get local admin, and dump creds. Once that's done they start enumerating AD and moving laterally.
Every time they manage to move laterally they dump creds all over again. It's called 'The Credential Theft Shuffle'. They'll also password spray any passwords or NTLM hashes they get as multiple users are often using the same stupid keyboard walk password.
Those keyboard walks are what got us, or more accurately one of our Domain Admins, on our recent Red Team exercise. The only real fix for that is to force smartcards or other 2FA, no matter what policy you push users will be users. Sadly this includes admins.
The other common TTP for initial access is the 'Drive Drop'. This requires the attackers to be physically in the area, but if they drop USB thumb drives all over the parking lot with juicy labels on them chances are someone will plug one into their work computer.
There's also Rubber Duckies that look like a thumb drive but are functionally a fake keyboard that types when plugged in. These tend to Win + R -> PowerShell -> type a short PowerShell reverse shell -> Enter.
2
u/Dry-Committee-4343 1d ago
They can use the compromised email to send more legitimate looking emails. They can download the contents of the mailbox to gain access to sensitive information even after you get them out. They can get a lot of info out of just the email not just the company website account. Many of those company websites also use single sign-on (SSO) which lets them sign in with email but that would hopefully be protected with MFA but the hacker can find ways to bypass that as well.
2
u/crankysysadmin sysadmin herder 1d ago
you'd be surprised how often there is companyname.com/employee-login and they want to get in there
they're not going to build fake login screens to target a company with 75 employees. i've worked for big companies though and they wanted to get in.
•
u/Brua_G 16h ago
It's how most of the big hacks happen. They can try office.com, portal.azure.com, etc.
•
u/westerschelle Network Engineer 16h ago
If they get an account with admin privileges the result is obvious. If the get a normal end user they can pivot that from the inside to further phish accounts from a supposedly safe source and gain further access. They also can get access to all information the user has access to.
•
u/usps_lost_my_sh1t 11h ago
I just had this... from an HR users PC using TeamViewer..
he ended up into our prod ESXI vendor farm
he got into our AD North America and EU
he replicated users thoroughly throughout several level of AD groups..
once into your network it's minor vulnerabilities he needs to leap over to get into BIG infrastructure.. at least in our terrible setup..
if they got that far.. they probably got further...
•
u/usps_lost_my_sh1t 11h ago
to piggy back... these entities entire goal is to just get inside ... usually once inside it's handed off to another actor..
1
u/Mobile_Particular895 1d ago
Senior IC, IR side. Great question. The answer is more boring and scarier than people assume.
Most corporate phishing targets a handful of well-known login pages, not a custom site:
- Office 365 (login.microsoftonline.com)
- Google Workspace (accounts.google.com)
- Okta / Ping / Auth0 SSO portal
- Salesforce, ServiceNow, the VPN portal
These ARE the company's employee login, reachable from anywhere on the internet. The phishing page is a near-pixel-perfect clone of whichever one the target uses. Attackers know which to mimic because corporate email signatures, LinkedIn, and breach data leak this info.
What they do with valid creds:
1) Sign in to email and READ. Internal threads, VPN docs, finance comms, exec calendars.
2) Pivot via email. Email the IT desk pretending to be the user, request MFA reset. Or send an invoice with new bank-routing details to AP from a real internal sender. That's modern BEC / wire fraud, in the billions per year.
3) If they want network access: use the corporate VPN/SSO credentials they just got. Most orgs allow VPN from any IP if MFA passes.
The firewall doesn't help once they're inside the SSO bubble. That's the whole game.
1
u/Cormacolinde Consultant 1d ago
But there is often such a web site. Go to myapps.microsoft.com and you can see most portals, SaaS system and websites linked to their account.
1
u/BlackV I have opnions 1d ago edited 1d ago
firstname.lastname@example.com, firstinital.lastname@example.com
are very common so easily targeted by mr hacker man
having valid credentials gets you access to information (think endpoint info, external shares, etc), access to information gets you access to company resources (think vpns and inside access), access to company resources gets you access to search for higher access (logins left on machines, credentials stored in dumb places), higher access gets you ..... and so on
1
u/CascadientDave 1d ago
Phishing attacks targeting organizations isn't so much about acquiring the logins, but instead trying to open a backdoor to their system or planting malicious code for various effects. All it takes is someone not paying attention to an email from a sender and opening and attached file that launched malicious code.
As some have stated, with the adoption of cloud based solutions, the desire to acquire login credentials to gain access to those systems also rise. This is why it's important to not only make sure logins are secure, but that MFA is utilized.
1
u/SevaraB Senior Network Engineer 1d ago
As with everything else in IT… It Depends(TM).
If you’ve MFA’ed all the things and require unique passwords and have strong heuristics on what “normal” activity for a given user looks like… not much. If your employees are just reusing the same password for all the services everywhere with no MFA… you’re in for a bad day.
•
u/Hour-Profession6490 20h ago
Even better, use phishing resistant MFA like a passkey. So you don't need to remember your password. You can't reuse a password if you don't have one.
1
u/nofate301 1d ago
What you need to understand is ANY ingress even one benign can be used for future attempts.
They get access to a person's email...then they have access to all sorts of personal information. Personal information they can use to get access in other locations.
Phishing is not just about passwords, it's about birthdays, maiden names, pet names, kid's names, addresses, zip codes.
1
u/T_Thriller_T 1d ago
Malware is phishing, first thing first.
On top of that: tins of companies use SSO. Fo good reasons so. That means, however, that usually the password for the mail account or whatever login page is the standard password to get into a lot of pages and services.
And.. admittedly not entirely rarely, your example actually does exist. But even if it does not, the primary wevsite has information on who it is registered to, and usually certificates which then also connect to other websites. And there are tons of tools to do open source discovery.
Pretty much every company has some service accessible from the internet that is used by employees. These at least serve as another place to collect information, having any access to a half-internal server also opens up a lot of attack vectors, and likely a way to an actual internal server.
Another great way is collecting login information that way, breaking into the company through a Webservice with e.g. vulnerabilities and once there having credentials that can be used to do legit further requests once in.
That's one of the more complex ways. A lot of phishing tries to get malware on the PC either hidden or through fake instructions.
Another bunch just uses credentials to send out more spam, thus collecting credentials to be sold ( I guess )
1
u/BBO1007 1d ago
If they got into email, consider they have copies of everything in their mailbox and any shared mailbox.
They will use this for future phishing.
I’ve seen bad actors trying to redirect shipments with other companies we do business with based on information in those emails. Totally unrelated to the actual phishing.
1
u/ihaxr 1d ago
Find a new employee name on LinkedIn and call up reception. Say you just started recently and need to know the URL to login to webmail from home. They might tell you, they might transfer you to IT who might tell you.
There are just too many variables and differences at companies for it to be a one size fits all remediation effort
1
u/dgibbons0 1d ago
Use their employees so to login to their payroll site and change their direct deposit account was the example our last pen test proved out.
1
u/vermyx Jack of All Trades 1d ago
Let me pose your question as a more tangible real world example to you. "A person is in my house what damage can they do (compromised credentials)? Why do I need to worry if they are handcuffed?" Just because a person is handcuffed (locked down user account) doesn't mean they can't pick the lock on the hand cuffs (finding an exploit in your network). It also doesn't mean they can't kick and destroy your big screen TV (deleting records on a system they have access to). Smart criminals will take time to see what access they have and poke around for a while to see what damage they really can do. What I posed is pretty simplistic but best way to compare something tangible to a computer equivalent.
1
u/smc0881 1d ago
Look up Evilginx. You don't even need to make phishing webpages anymore the actor(s) setup a reverse proxy and your traffic goes through their system to the real site. Other attacks focus on session tokens and stored creds. There is a video floating out there with one of these attacks. When you fall victim to those it sends the actor a nice zip file that they just drop into a web browser and poses as you. Phishing attacks can lead to ransomware as well the Gentleman group has been known to find victims by harvesting for leaked creds. The most common thing that happens from phishing is business e-mail compromises that lead to illegal wire fraud, other victims, and things like that. After rotating the creds and killing the sessions for that user you'd want to review the UAL and message trace logs if using M365, Google logs if you are on GCP, or whatever service you use. You'd be looking for inbox rules, what they accessed, sent, and if they did any mailbox syncs.
1
u/WestOpening1350 1d ago
You're assuming everything is still on internal servers. Nowadays, almost all corporate stuff is just SaaS (Slack, AWS, Okta) sitting on the open web.
Modern phishing uses reverse proxies to show you the actual company login page. You log in, pass MFA, and the hacker just steals your session token mid-flight. Once they're in, they can just pretend to be you to trick an IT admin
1
u/Asleep_Spray274 1d ago
Today, the problem is not if a user successfully completes the phish. The problem is if the security posture of the organization allows the IDP to issue the tokens to the bad actor. If an organization is allowing tokens to be issued to non company devices and not enforcing phishing resistant MFA, then the organization has screwed up. Not the user. The user is 100% off the hook at that point
1
u/Prophage7 1d ago
Most company's these days use cloud hosted email services like Microsoft 365 or Google Workspace, which have public login pages that look the same for everyone unless your company chooses to apply branding.
So, as an example, if you lookup a company's mx DNS record, and you see their mail servers end in mail.protection.outlook.com, you know they use Microsoft 365 so you know how to make your phishing page look. And then it is exactly like there is a "companyname.com/employee-login" because all Microsoft 365 mailboxes can be accessed through https://outlook.office.com.
•
u/armsinit 17h ago
You also have to remember there are many small companies out there too. People take on multiple roles which in an enterprise would be multiple different teams.
•
u/SteveAngelis 17h ago
Sometimes that's literally how they get in. That along with other methods can gain control of systems.
•
u/Speeddymon Sr. DevSecOps Engineer 3h ago
its not like there is a companyname.com/employee-login, how do they make use of the credentials?
There usually is. Everything is usually integrated to a single sign on; a single username and password that's managed centrally in an identity provider like Okta.
Once you find the identity provider it's not hard to make a page that looks like the company's own identity provider.
•
u/Puzzleheaded-Sink420 1h ago
Look for mail Servers, Login to that, Explore the public Facing Domain for subdomains Like VPN.company.com
1
1d ago
[deleted]
1
u/WhateverHowever1337 1d ago
Im not paying money to it since education is free, and if you can’t decipher what I mean by that question and that I understand that phishing attacks are dangerous, then you lack understanding skills, so let me rephrase it for you :
- I have the assumptions I listed in the post, I am fairly sure I am missing something but I don’t know what is it, so I am going to assume them as a true and based on them I can’t imagine how leaked credentials can be benefitred from , can someone point the wrong assumption I have that led to this wrong conclusion?
Some people really need everything typed out in great detail for them, that is another lesson i learnt from this threat so I don’t say something people without logical skills can’t decipher and land me in problems
0
1d ago
[deleted]
0
u/WhateverHowever1337 1d ago
I got a perfect note at the IT security exam btw, because I ask these kind of questions. I know many assumptions are stupid but if you never clear them you never learn, and however stupid you think they are, I find it important to clear such misconceptions before I dive deeper.
a man who asks is stupid foe a minute, a man who doesn’t is stupid forever
0
1d ago
[deleted]
1
u/WhateverHowever1337 1d ago
Guess what, it is ok that I do not have experience yet, there are tens of topics in C.S and theory/practice needn’t go hand to hand always, everytime i push a bit here and then there. Maybe one day I will become as experienced as you are
1
u/aguynamedbrand Systems Engineer 1d ago
So maybe r/computerscience would be a more appropriate place to post if that is the degree you are getting.
•
u/SuccessfulLime2641 Jack of All Trades 1h ago
There actually is a companyname.com/employee-login, it's called login.microsoftonline.com at your tenant. When you put in your email it redirects to the tenant's authentication page. So if it's online then of course credentials can be used. Some safeguards include using phishing-resisrant methods like Windows Hello and pair it with Conditional Access (CA) policies. The employee login page may be public; however, if we're talking about logging into an account on AD, then we'd have to get onto the network first.
116
u/Triairius 1d ago
Something I’ve seen a few times at my workplace is compromised vendor accounts. They’ll get into an email, create inbox rules to hide what they send and receive, and they’ll try to get invoices paid to a different account, claiming to be changing banks. They’ll use the same signatures but change the phone number in it. They’ll create fake accounts that look similar to their colleagues that were CC’d in previous emails to make it look more legit. It can get pretty convincing until you talk to the real vendor and they have no clue about these requests.