chat
expand_more

LogMeIn Impersonated in Credential Phishing Attack

We’ve seen an incredible uptick in collaboration software impersonations in the past month as the COVID-19 pandemic has forced people to work at home. Most of these attacks are associated with platforms like Google Workspace and Office 365, which can be...
May 19, 2020

We’ve seen an incredible uptick in collaboration software impersonations in the past month as the COVID-19 pandemic has forced people to work at home. Most of these attacks are associated with platforms like Google Workspace and Office 365, which can be leveraged by attackers to gain access to or assault other accounts. However, we've also seen a rise in attacks on Zoom, Microsoft Teams, and other collaboration tools.

In May, we began to observe new email attack campaigns impersonating LogMeIn, after previously seeing none. This is likely due to various news stories about the troubled infrastructure and security of video conferencing platforms, as cybercriminals can engage with victims and steal credentials while avoiding scrutiny.

Summary of Attack Taret

  • Platform: Office 365
  • Victims: Employees
  • Payload: Malicious Link
  • Technique: Impersonation

Overview of the LogMeIn Credential Phishing Attack

The email claims to be from LogMeIn, informing the recipient of a patch to a zero-day vulnerability in some of the company’s offerings. The user must update by following the link given, which impersonates an actual LogMeIn URL.

Users may be tricked by the fake URL, as it looks like what they would expect from the system. However, it redirects to a phishing page owned by the threat actor.

From here, the phishing page asks for email address and password. Should recipients fall victim to this attack, their login credentials to their LogMeIn account would be compromised. Additionally, since LogMeIn has SSO with LastPass as the parent company, it is possible the attacker may be attempting to obtain access to this user’s password manager.

Why the LogMeIn Credential Phishing Attack is Effective

Other collaboration platforms have been under scrutiny for their security, as many have become dependent on them to continue their work given the current pandemic. Because of this, frequent updates have become common as many platforms are attempting to remedy the situation. The cybercriminal is taking advantage of the situation, knowing that a recipient may be more inclined to update right now.

In addition, the link attack vector was hidden using an anchor text impersonation to make it appear to actually be directing to the LogMeIn domain. Furthermore, throughout this attack, imagery found in legitimate LogMeIn pages is found in both the email and the phishing page. Additionally, the LastPass image shows an in-depth knowledge of the impersonated company and its offerings.

Abnormal can stop this due to a variety of factors, including the suspicious sender and the malicious link. Even though the text of the link has been obscured, Abnormal can follow the actual URL to determine the malicious nature of both the email and the landing page. Combined with the body text, which showcases an attempt to gather information, it becomes obvious that this email is dangerous and it is blocked before entering inboxes.

Learn more about how Abnormal protects employees from credential phishing by requesting a free demo today.

LogMeIn Impersonated in Credential Phishing Attack

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B AI Mbx Prompts
Discover how to unlock the full potential of the AI Security Mailbox with custom prompts designed to enhance your generative AI output.
Read More
B Protecting Microsoft Accounts Blog
Microsoft, with its vast user base, is a prime target for cybercriminals. Discover the top 5 attack strategies used to compromise its users and systems.
Read More
B Convergence S3 Announcement Blog
Join us for Season 3 of The Convergence of AI + Cybersecurity as we explore deepfakes, the evolving role of the SOC, and the intricacies of AI-native security.
Read More
B AISM Augmenting Customer Facing Product with AI Blog
Learn how Abnormal Security leverages large language models (LLMs) to enhance security awareness and automate SOC teams’ workflows with AI Security Mailbox.
Read More
B Education Targeted Attacks Blog
Cyberattacks on schools have surged, exposing 650K+ records in the last 60 days. As the school year begins, phishing is a key threat to students, teachers, and staff.
Read More
B Fed RAMP Announcement Blog
Abnormal is pursuing FedRAMP Moderate authorization, which enables us to empower federal agencies with AI-native email security against advanced cyber threats.
Read More