Credential Phishing Attack Hosted on Atlassian Confluence

September 23, 2021

Credential phishing links are most commonly sent by email, and they typically lead to a website that is designed to look like common applications—most notably Microsoft Office 365, Google, Amazon, or other well-known brands. A rising trend is attackers frequently like to use links leading to shared documents on Google Docs or Dropbox to steal credentials.

This attack is the first we’ve observed hosted on a Confluence page and while much less common, shows how attackers are willing to try nearly everything to steal your information and money.

Summary of Attack Target

  • Target: Prominent Healthcare System
  • Platform: Office 365
  • Victims: Hospital Administrators
  • Payload: Phishing Link
  • Technique: Credential Theft

About the Confluence Phishing Attempt

Utilizing the compromised account of a trusted lawyer out of a notable firm, cybercriminals began their spear-phishing campaign by attacking an equally noteworthy health care system. This may have been an attempt to steal valuable personal information—something that is highly prevalent in healthcare systems and makes them a prime target for attack.

The spear-phishing, or highly targeted, email disguised the malicious web page with a seemingly innocent RFP—a new method of attack that has seen increasing use over the last year. The use of the phrases secure link and please do not share this email offer a sense of security and trustworthiness, indicative of suspicious behavior.

Confluence spear phishing attack email

Once the link is clicked, the recipient is taken to a Confluence web page where the malicious file is stored. Here, the recipient is greeted with more suspicious wording including SECURE FILE and This document is protected for your view only. By attempting to create a relationship of trust and security with the recipient, attackers are able to successfully entice recipients to click on the malicious links.

Confluence attack landing

While the malicious OPEN HERE link was removed prior to Abnormal investigating this email, we can determine that it was likely leading users to a phishing website where they would be required to enter their credentials to their Office 365 account in order to see the RFQ. Email credentials are typically the most valued by threat actors, as they can hijack existing conversations and send additional phishing emails from the compromised account.

Alternatively, this link could have led to an impersonated Confluence page, where the user would enter their Confluence credentials in order to access the PDF. Once entered, the threat actor would have access to the organization’s Confluence workspace where they could view all internal documentation about the healthcare organization and potentially gain access to other, more private systems that contained personal patient information.

Why the Confluence Attack Bypassed Existing Security Infrastructure

Attackers are constantly looking for new ways to compromise targets and are adapting their methods to seem more official and real. Atlassian Confluence is one of many different applications that are used throughout the professional world and is one way that teams create and collaborate across a network of distributed employees.

Confluence is best known as a place to organize and share work, and while it is not used solely for file sharing, that is a key component of the system. Attackers took advantage and staged the malicious payload under the guise of an application that they knew the target would recognize. In addition, placing the phishing link on another site allowed the original email to bypass traditional security systems, which typically look only at the first link to determine malicious intent.

Despite the attempt cybercriminals made, Abnormal Security was able to detect several different indicators that the email was likely an attack.

Confluence attack analysis

Abnormal detected the unusual sender domain and the fact that all recipients were bcc’d—a common technique of attackers. Furthermore, Abnormal noticed the suspicious link, which redirected to another webpage. These different facets of attack, alongside thousands of other signals, were detected through the behavioral models and AI technology on which the Abnormal platform is built.

While Abnormal stopped this attack for the healthcare system, other recipients who were bcc’d may have fallen victim to this credential phishing attempt, particularly if their organizations regularly use Confluence for documentation. This attack would be particularly effective for organizations that regularly communicate with the original sender and who may be expecting an RFQ to be sent from them.

Are you prepared to stop credential phishing attacks from compromised accounts? See how Abnormal can help by requesting a demo today.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 10 3 22 Cobalt Terrapin Blog
Threat group Cobalt Terrapin uses sophisticated impersonation techniques with multiple steps to commit invoice fraud.
Read More
B 09 29 22 CISO Cybersecurity Awareness Month
October is here, which means Cybersecurity Awareness Month is officially in full swing! These five tips can help security leaders take full advantage of the month.
Read More
B Email Security Challenges Blog 09 26 22
Understanding common email security challenges caused by your legacy technology will help you determine the best solution to improve your security posture.
Read More
B 5 Crucial Tips
Retailers are a popular target for threat actors due to their wealth of customer data and availability of funds. Here are 5 cybersecurity tips to help retailers reduce their risk of attack.
Read More
B 3 Essential Elements
Legacy approaches to managing unwanted mail are neither practical nor scalable. Learn the 3 essential elements of modern, effective graymail management.
Read More
B Back to School
Discover how threat group Chiffon Herring leverages impersonation and spoofed email addresses to divert paychecks to mule accounts.
Read More
B 09 06 22 Rearchitecting a System Blog
We recently shared a look at how the Abnormal engineering team overhauled our Unwanted Mail service architecture to accommodate our rapid growth. Today, we’re diving into how the team migrated traffic to the new architecture—with zero downtime.
Read More
B Industry Leading CIS Os
Stay up to date on the latest cybersecurity trends, industry news, and best practices by following these 12 innovative and influential thought leaders on social media.
Read More
B Podcast Engineering 11 08 24 22
In episode 11 of Abnormal Engineering Stories, David Hagar, Director of Engineering and Abnormal Head of UK Engineering, continues his conversation with Zehan Wang, co-founder of Magic Pony.
Read More