chat
expand_more

LogMeIn Impersonated in Credential Phishing Attack

We’ve seen an incredible uptick in collaboration software impersonations in the past month as the COVID-19 pandemic has forced people to work at home. Most of these attacks are associated with platforms like Google Workspace and Office 365, which can be...
May 19, 2020

We’ve seen an incredible uptick in collaboration software impersonations in the past month as the COVID-19 pandemic has forced people to work at home. Most of these attacks are associated with platforms like Google Workspace and Office 365, which can be leveraged by attackers to gain access to or assault other accounts. However, we've also seen a rise in attacks on Zoom, Microsoft Teams, and other collaboration tools.

In May, we began to observe new email attack campaigns impersonating LogMeIn, after previously seeing none. This is likely due to various news stories about the troubled infrastructure and security of video conferencing platforms, as cybercriminals can engage with victims and steal credentials while avoiding scrutiny.

Summary of Attack Taret

  • Platform: Office 365
  • Victims: Employees
  • Payload: Malicious Link
  • Technique: Impersonation

Overview of the LogMeIn Credential Phishing Attack

The email claims to be from LogMeIn, informing the recipient of a patch to a zero-day vulnerability in some of the company’s offerings. The user must update by following the link given, which impersonates an actual LogMeIn URL.

Users may be tricked by the fake URL, as it looks like what they would expect from the system. However, it redirects to a phishing page owned by the threat actor.

From here, the phishing page asks for email address and password. Should recipients fall victim to this attack, their login credentials to their LogMeIn account would be compromised. Additionally, since LogMeIn has SSO with LastPass as the parent company, it is possible the attacker may be attempting to obtain access to this user’s password manager.

Why the LogMeIn Credential Phishing Attack is Effective

Other collaboration platforms have been under scrutiny for their security, as many have become dependent on them to continue their work given the current pandemic. Because of this, frequent updates have become common as many platforms are attempting to remedy the situation. The cybercriminal is taking advantage of the situation, knowing that a recipient may be more inclined to update right now.

In addition, the link attack vector was hidden using an anchor text impersonation to make it appear to actually be directing to the LogMeIn domain. Furthermore, throughout this attack, imagery found in legitimate LogMeIn pages is found in both the email and the phishing page. Additionally, the LastPass image shows an in-depth knowledge of the impersonated company and its offerings.

Abnormal can stop this due to a variety of factors, including the suspicious sender and the malicious link. Even though the text of the link has been obscured, Abnormal can follow the actual URL to determine the malicious nature of both the email and the landing page. Combined with the body text, which showcases an attempt to gather information, it becomes obvious that this email is dangerous and it is blocked before entering inboxes.

Learn more about how Abnormal protects employees from credential phishing by requesting a free demo today.

LogMeIn Impersonated in Credential Phishing Attack

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B Podcast Blog
Explore insights on AI, collaboration, career growth, and unforgettable stories from industry leaders shaping the future of cybersecurity.
Read More
B AI Vendor
Learn how to evaluate transparency, risks, scalability, and ethical considerations to make informed cybersecurity decisions.
Read More
B SOC Prod
Learn how AI-driven automation boosts SOC productivity by reducing false positives, addressing skills gaps, and enhancing threat detection. Discover strategies to future-proof your SOC and strengthen cybersecurity defenses.
Read More
B Proofpoint Customer Story F500 Insurance Provider
A Fortune 500 insurance provider blocked 6,454 missed attacks and saved 341 SOC hours per month by adding Abnormal to address gaps left by Proofpoint.
Read More
B Malicious AI Platforms Blog
What happened to WormGPT? Discover how AI tools like WormGPT changed cybercrime, why they vanished, and what cybercriminals are using now.
Read More
B MKT748 Open Graph Images for Cyber Savvy 7
Explore insights from Brian Markham, CISO at EAB, as he discusses cybersecurity challenges, building trust in education, adapting to AI threats, and his goals for the future. Learn how he and his team are working to make education smarter while prioritizing data security.
Read More