TOAD Attacks via Entra Guest Invites

We have identified a new phishing/reverse phishing campaign that uses Microsoft Entra tenant invitations to trick recipients into calling a telephone number, referencing a fictitious bill. From the phone number, normal TOAD TTPs are in play. The use of Entra Guest user invitations seems solely to take advantage of the Message field in the Guest User invitation.

This field can be arbitrarily long, and is used to create a phishing lure. Invites will come from invites@microsoft[.]com, which is a legitimate address and likely won't be blocked by email filters. This is similar to previous campaigns that use message fields in notifications from trusted services to embed a phishing lure.

Recommended Actions

If you have access to email logs, I recommend searching for listed strings below. IoCs

| Indicator | Type | Description | | -------------------------------------------------------------- | ------ | ------------------------------------------------------------ | | invites@microsoft[.]com | Email | Sender address for Entra invites | | invited you to access applications within their organization | String | Email Subject substring to search for Guest User invitations | | CloudSync | String | Attacker Tenant Name | | Advanced Suite Services | String | Attacker Tenant Name | | TenantHub | String | Attacker Tenant Name | | Unified Workspace Team | String | Attacker Tenant Name | | Advanced Suite Services | String | Attacker Tenant Name | | x44xfqf.onmicrosoft[.]com | Domain | Attacker Tenant Domain | | woodedlif.onmicrosoft[.]com | Domain | Attacker Tenant Domain | | xeyi1ba.onmicrosoft[.]com | Domain | Attacker Tenant Domain | | x44xfgf.onmicrosoft[.]com | Domain | Attacker Tenant Domain | | 18052948531 | Telephone Number | Listed Number in observed lures

Acknowledgments

Thanks to Ian Campbell and cr0w for additional corroboration on this campaign.