Microsoft Uncovers Banking AitM Phishing and BEC Attacks Targeting Financial Giants

 

Banking and financial services organizations are the targets of a new multi-stage adversary-in-the-middle (AitM) phishing and business email compromise (BEC) attack, Microsoft has revealed.

"The attack originated from a compromised trusted vendor and transitioned into a series of AiTM attacks and follow-on BEC activity spanning multiple organizations," the tech giant disclosed in a Thursday report.

Microsoft, which is tracking the cluster under its emerging moniker Storm-1167, called out the group's use of indirect proxy to pull off the attack.

This enabled the attackers to flexibly tailor the phishing pages to their targets and carry out session cookie theft, underscoring the continued sophistication of AitM attacks.

The modus operandi is unlike other AitM campaigns where the decoy pages act as a reverse proxy to harvest credentials and time-based one-time passwords (TOTPs) entered by the victims.

"The attacker presented targets with a website that mimicked the sign-in page of the targeted application, as in traditional phishing attacks, hosted on a cloud service," Microsoft said.

"The said sign-in page contained resources loaded from an attacker-controlled server, which initiated an authentication session with the authentication provider of the target application using the victim's credentials."

The attack chains commence with a phishing email that points to a link, which, when clicked, redirects a victim into visiting a spoofed Microsoft sign-in page and entering their credentials and TOTPs.

The harvested passwords and session cookies are then used to impersonate the user and gain unauthorized access to the email inbox by means of a replay attack. The access is then abused to get hold of sensitive emails and orchestrate a BEC attack.

What's more, a new SMS-based two-factor authentication method is added to the target account in order to sign in using the pilfered credentials sans attracting any attention.

In the incident analyzed by Microsoft, the attacker is said to have initiated a mass spam campaign, sending more than 16,000 emails to the compromised user's contacts, both within and outside of the organization, as well as distribution lists.

The adversary has also been observed taking steps to minimize detection and establish persistence by responding to incoming emails and subsequently taking steps to delete them from the mailbox.

Ultimately, the recipients of the phishing emails are targeted by a second AitM attack to steal their credentials and trigger yet another phishing campaign from the email inbox of one of the users whose account was hacked as a result of the AitM attack.

"This attack shows the complexity of AiTM and BEC threats, which abuse trusted relationships between vendors, suppliers, and other partner organizations with the intent of financial fraud," the company added.

The development comes less than a month after Microsoft warned of a surge in BEC attacks and the evolving tactics employed by cybercriminals, including the use of platforms, like BulletProftLink, for creating industrial-scale malicious mail campaigns.

Another tactic entails the use of residential internet protocol (IP) addresses to make attack campaigns appear locally generated, the tech giant said.

"BEC threat actors then purchase IP addresses from residential IP services matching the victim's location creating residential IP proxies which empower cybercriminals to mask their origin," Redmond explained.

"Now, armed with localized address space to support their malicious activities in addition to usernames and passwords, BEC attackers can obscure movements, circumvent 'impossible travel' flags, and open a gateway to conduct further attacks."

UK’s Tide raises $14M to challenge big banks with a mobile-first service for SMBs

Europe has seen a large wave of startup banks pop up in the last few years — companies like N26, Atom and Monzo that are taking on the big incumbents by creating faster and cheaper services for a new class of consumers as they grow up and enter the working world. Now a startup has raised a sizeable Series A to tackle what it believes is a similar opportunity in the small business world.

Tide, a UK-based, mobile-first banking service targeting small and medium enterprise customers, has picked up a Series A of $14 million, one of the bigger rounds for a fintech startup in Europe this year. The investment was led by Anthemis (the London-based fintech investor that has also backed Azimo, Currencycloud, Betterment and Simple) and Creandum (investor in Spotify and many other high-profile European startups), and is joined by Passion Capital and LocalGlobe, which backed Tide in a $2 million seed investment last year. Eileen Burbidge of Passion Capital is also Tide’s chairperson.

Alongside this, Tide is announcing a new partnership with European online lender iwoca, to initiate its first loan program, offering up to £100,000 starting later this summer. (iwoca is an obvious fit for Tide. It is part of the bigger wave of new online lenders that taps big data sets to assess the risk of giving out loans faster and cheaper than traditional banks.)

The funding will be used to help Tide continue to build out its service. The company is not disclosing its valuation or revenues but CEO and founder George Bevis said in an interview that it is on track to have “tens of thousands” of business customers banking with it; it is growing at 10 percent each week; and it has ambitions to expand to more markets to serve the tens of millions of small businesses that are in existence today. 

Tide’s unique selling point is that it provides a less expensive and faster service to smaller businesses who lack the staffing to run the accounting and admin sides of their businesses efficiently.

“People who run small businesses waste time with crappy administrative tasks, so we work out smart ways with software to automate these things,” Bevis said.

Tide promises faster account activation and anumber of other services to speed up a businesses banking and accounting activities. These include faster and cheaper systems to generate invoices and get them paid (and in turn to pay invoices sent to the business — one service uses AI to ‘read’ invoices that are sent to the business to automatically figure out basic details like account number, purpose of the invoice and money owed to automatically pay these without involving the business owner in the process of doing it all — like a virtual bookkeeper or accounts payable department). The company has a transparent and low fee structure: among them, it charges 20 pence for any money transfer and £1 for any ATM withdrawals, but no transaction fees on card purchases, and no account fees — making Tide attractive to those businesses that have small turnovers but typically still face bank charges that are designed for larger businesses.

The plan is to open Tide in other markets outside the UK starting next year, Bevis said. That is a signal that this Series A is really just a stopping point before a larger growth round in the future, hinted Simon Schmincke of Creandum.

The SMB market has become something of a classic target for financial services startups: part of the reason is because smaller businesses have often fallen in the gap between consumers (who as a group produce low margins but make up for it in scale) and big businesses (there are fewer of these but they are far more stable and higher-margin when you finally land them as customers).

Typically, the amount of money that an SMB customer deposits with Tide is in the region of thousands of pounds, and less than £10,000, making them less attractive to average banks, while still subjecting those smaller companies to those bigger banks’ too-high fees and cumbersome processes.

Other fintech startups have honed in on the opportunity to disrupt SMBs’ existing banking relationships by tapping into technological innovations — and in the best cases, these startups provide groundbreaking options to those businesses. Point-of-sale payment providers like Square and iZettle, for example, provide payment services that are faster and cheaper by using dongles that attach to smartphones and tablets. These let sole traders and small businesses accept card payments, often for the first time ever since previous card acceptance schemes would have been too cost-prohibitive.

Unsurprisingly, Tide is not the only banking startup that wants to address the SME business banking opportunity, but it one of the biggest and perhaps the most promising of these coming out of the UK.

Others include YC-backed Seed in the U.S. and Qonto in France. Notably, Holvi out of Finland, which is also tackling the small business current account opportunity, was acquired by Spanish giant BBVA last year, which also points to how the bigger banks are sitting up and taking notice. (BBVA has established a track record of investing in and buying fintech startups to try to address the opportunity of a new class of consumers and banking customers. Investments include Atom Bank and other acquisitions include Simple in the U.S.)

While part of Tide’s USP is built around the various tech tools it has created to help manage its customers’ money, the other part of how the business works is based on how it’s been stitched together behind the scenes. For now, Tide does not have a full banking license, and instead it partners with Prepay Solutions, which is partly owned by Mastercard and provides it with a white label service. It also ultimately bundles the values of all the accounts to hold them in bulk with Barclays, Bevis told us.

Longer term, the company may choose to apply for a full license, said Schmincke at Creandum, but for now this is a better solution for how Tide is building its business, said Bevis, who points out that getting a partial license as Tide has done is not uncommon among fintech startups targeting small businesses.

“In B2B, businesses are much more diverse and the margins are better than in conusmer, so for us it makes sense to focus our energy and effort instead on other areas,” he said. “Rather than replicating commoditised banking, we sit on top of other’s capabilities and licenses and focus on differentiating. That’s a lengthy way of saying we have no plans to get a license soon.”