A sophisticated phishing scheme is targeting Microsoft OneDrive users by employing social engineering tactics to trick individuals into executing harmful PowerShell scripts.
This attack creates a false sense of urgency by falsely claiming that a DNS issue is preventing access to files, leading users to click a button that activates a PowerShell script and compromises their systems.
Phishing Attack via Email Exploiting Social Engineering
The attack begins with a malicious HTML file sent through email. When opened, this file presents a fake OneDrive page with a fabricated error message.
The error message is crafted to provoke urgency and fear, manipulating users into updating their DNS cache manually. This action could lead them to a compromised site or initiate a malware download.
By using a valid error code, the attack enhances its credibility through familiar visual cues. The “Details” button on the page links to a genuine Microsoft Learn DNS troubleshooting guide, while the “How to Fix” button triggers a malicious JavaScript function called “GD” and shows additional misleading instructions.
This deceptive mix of credible information and urgent prompts is designed to coerce users into executing malicious code.
Buttons “Details” and “How to Fix” Actions
The “How to Fix” button directs users to a prompt that executes a specific command in the Windows PowerShell terminal. This involves accessing the Quick Link menu, opening the PowerShell terminal, pasting a pre-determined command, and running it.
The function labeled “GD” likely targets a system component or process with a command intended to address the purported issue.
The script starts by decoding a Base64-encoded string—likely a command title—using the atob() method, then copies it to the clipboard with the execCommand method. A segment of the command remains encoded in Base64 within the clipboard. Decoding this part reveals a command that might involve network configuration changes, file downloads, and execution of a malicious script.
Analysis of Command Sequence
The command sequence uses social engineering to lure users into opening malicious HTML files. Once executed, the script clears the DNS cache, downloads a hidden archive to a local directory, extracts a harmful script and its executor, and silently runs the script using AutoIt3.
Although Trellix’s detection capabilities helped mitigate this attack, it underscores the persistent threat of HTML-based exploits and the importance of user education in preventing such breaches.
The global impact of this attack is evident in the geographic distribution of compromised systems, highlighting the widespread nature of such threats.
