Phishing PreTexting
A phishing attack exploits a victim’s behavior,
leveraging their curiosity or fear to encourage them to launch our payload
despite their better judgement.
When using Microsoft Office in a phishing attack,
an attacker will typically present a document,
state that the document is encrypted or protected,
and suggest that the user must Enable Editing
and Enable Content to properly view the document.
Once the user has opened the document, we should try to allay their suspicions.
If the document is poorly constructed, or seems like spam,
they may alert support personnel, which could compromise our attack.
We should also make an effort to make the document look legitimate
by including product names and logos the users likely know and trust
such as Microsoft or encryption standards like RSA.
We’ll propose that the attached job application document is encrypted
to protect its content in accordance with GPDR regulations.
If the victim does not have a strong technical background,
these added terms and “tech magic” can make the document seem more legitimate.
In this case, we’ll simply add some random base64-encoded text
and a note about GDPR compliance:
To improve the perception of legitimacy, we can also add an RSA logo in the header.
In this particular example, our victim works in human resources
and the target organization has posted an opening for a human resources analyst.
Because of this, we’ll keep our document centered on this pretext.
The bottom line is that we must keep up appearances to avoid alerting the victim.