Legitimate Dropbox Transfer Used to Phish Microsoft Credentials

June 10, 2020

As the COVID-19 pandemic continues, governments worldwide are providing relief funds for small business owners impacted by lockdowns and closures. This allows attackers to exploit current efforts by the government, particularly since applicants to these funds typically have to provide documents to prove their eligibility.

Since applicants are expecting email correspondence, this provides attackers with a unique opportunity to impersonate legitimate authorities and extract sensitive information from customers. In this attack, threat actors use a Dropbox link and landing page to do so.

Summary of Attack Target

  • Platform: Office 365
  • Victims: Small Business Owners
  • Payload: Phishing
  • Technique: Impersonation

Overview of the Dropbox Transfer Attack

The email itself is an automated message from the sender “no-reply@dropbox.com” which is an official Dropbox domain. The body contains a link to the file “COVID-19-Relief-Payment.PDF” with information about the size of the file, a brief description of the file, and the expiration date.

The attack itself is a two-step process. First, the recipient must click the link provided in the email, which leads to a standard Dropbox transfer landing page with the enablement to download the file.


After clicking on the download button, the page is redirected to a phishing landing page. In the second step, the landing page contains an O365 image with a button to “Access Document”. This is where the intent is revealed, which is to gain access to the user's Microsoft credentials.

In order to access the fake document, the user must input their Office 365 credentials. The moment they do so, their Microsoft credentials on all accounts are compromised, providing access to Outlook, SharePoint, OneDrive, Teams, and other Microsoft applications. From there, this account takeover can lead to data or financial loss for the organization, and the account itself can be used to send additional attacks on employees, customers, or partners.

Why the Dropbox Transfer Attack is Effective

There is a sense of urgency in the message, which states, "Heads up, this transfer expires in 4 days on June 10, 2020.” It appears that if the recipient doesn't download the file within the given timeframe, the file will expire and they might assume that the opportunity to receive relief funding will be missed or delayed. And even for vigilant email recipients who check the sender address, an automated message from the dropbox.com domain does look innocuous enough to at least click on the links provided.

This is a sophisticated attack because, by using Dropbox Transfer to send files, it is not necessary to spoof headers, as the sender name will come from the legitimate Dropbox domain. Not only does this bypass traditional mail filters, but it also goes undetected by any existing web proxy and firewall controls. This is also extremely convenient for attackers because they can send the payload without ever having to verify if the targeted network is allowing an inbound SMTP or testing firewalls/proxies.

Abnormal can stop this attack due to the unusual sender domain where it does not match any domains found in body links. In addition, the content of the email is related to COVID-19, a common theme right now for cyber attackers who are looking to take advantage of the pandemic.

To learn how Abnormal can protect your employees from Dropbox transfers and other malicious emails, request a demo today.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 06 21 22 Threat Intel blog
Executives are no longer the go-to impersonated party in business email compromise (BEC) attacks. Now, threat actors are opting to impersonate vendors instead.
Read More
B 06 7 22 Disentangling ML Pipelines Blog
Learn how explicitly modeling dependencies in a machine learning pipeline can vastly reduce its complexity and make it behave like a tower of Legos: easy to change, and hard to break.
Read More
B 04 07 22 SEG
As enterprises across the world struggle to stop modern email attacks, it begs the question: how are these attacks evading traditional solutions like SEGs?
Read More
Enhanced Remediation Blog Cover
The most effective way to manage spam and graymail is to leverage a cloud-native, API-based architecture to understand identity, behavior, and content patterns.
Read More
B 05 16 22 VP of Recruiting
We are thrilled to announce the addition of Mary Price, our new Vice President of Talent. Mary will support our continued investment in the next generation of talent here at Abnormal.
Read More
B 06 01 22 Stripe Phishing
In this sophisticated credential phishing attack, the threat actor created a duplicate version of Stripe’s entire website.
Read More
B Podcast Engineering9
In episode 9 of Abnormal Engineering Stories, Dan sits down with Mukund Narasimhan to discuss his perspective on productionizing machine learning.
Read More
B 05 31 22 RSA Conference
Attending RSA Conference 2022? So is Abnormal! We’d love to see you at the event.
Read More
B 05 27 22 Active Ransomware Groups
Here’s an in-depth analysis of the 62 most prominent ransomware groups and their activities since January 2020.
Read More
B 05 24 22 ESI Season 1 Recap Blog
The first season of Enterprise Software Innovators (ESI) has come to a close. While the ESI team is hard at work on season two, here’s a recap of some season one highlights.
Read More
B 05 13 22 Hiring Experience
Abnormal Security is committed to offering an exceptional experience for candidates and employees. Hear about our recruiting and onboarding firsthand from three Abnormal employees.
Read More
B 05 11 22 Scaling Out Redis
As we’ve scaled our customer base, the size of our datasets has also grown. With our rapid expansion, we were on track to hit the data storage limit of our Redis server in two months, so we needed to figure out a way to scale beyond this—and fast!
Read More