Complimentary Email Security Risk Assessment

See if your organization’s current email security stops the latest BEC, malicious attachments, files, and other exploits. It deploys in minutes - with no change to current infrastructure - and you'll get personalized insights showing attacks your current email security missed.

Get it Now

It’s Time to Get Started with SlashNext

Learn how to leverage the industry’s best zero-hour phishing protection and IR solutions in your environment.

request a demo

Trusted Services Compromise

Commonly used to launch phishing attacks or hack other trusted domains

A domain, service or site with trusted reputation can become compromised and it’s used to launch phishing attacks or hack other trusted domains. By leveraging the trusted reputation of domains, including AWS, Azure, outlook.com, and sharepoint.com, cybercriminals have the opportunity to easily evade current detection technologies using domain reputation and blocklists like SEG, proxy, SASE, and endpoint security tools. Attackers are using shared services to get around domain reputation technologies with increased frequency.

As more threat actors leverage trusted infrastructure and manipulate trusted brands, it’s becoming harder and harder to stop these phishing attacks and cybersecurity threats. Whether it’s from credential-stealing or legitimately purchased cloud services. Cybercriminals can employ phishing emails containing links to legitimate cloud providers – including AWS, Azure, Alibaba, and Google – hosting phishing sites. Regardless of how access to trust domains occurs, the consistent element in these attacks is the initial URL is legitimate to avoid detection. Once clicked, the URL is redirected to a phishing page hosted elsewhere.

How Cybercriminals Gain Access to Trusted Services and Domains

A popular tactic to gain access to trusted services is account takeover. Once a cybercriminal has access to Microsoft 365 credentials from one company, they can initiate attacks against other companies, and those targets will have a sense of trust.

Once the bad actor has access to Office 365 credentials, they will send emails to their targets using the trusted email and Microsoft One Drive or OneNote to deliver a P.O. or invoices from a trusted site. They might also choose to continue to steal more credentials for ransomware, data exfiltration, or malware injection at a later date.

What You Can Do to Protect Yourself

While it is important to train users on how to identify phishing and social engineering, training users to detect phishing attacks from trusted services can be difficult. While it’s possible to identify illegitimate websites and other ploys, it’s harder to identify legitimate websites that are used to mask the malicious URL. The best defense against these attacks is threat detection technology that can follow URL re-directs and examine each subsequent page’s contents rather than focusing singularly on the URL analysis or domain reputation analysis of only the initial page.

SlashNext sees through evasion tactics and detects previously unknown, zero-hour threats including, compromised websites and trusted hosting service, shortened links. multiple redirects and other types of obfuscation. SlashNext SEER^TM technology is AI powered cloud detection and LiveScan can detects zero-hour phishing threats including those threats on domains, services or site with trusted reputation.