{"id":27974,"date":"2026-07-01T11:49:40","date_gmt":"2026-07-01T09:49:40","guid":{"rendered":"https:\/\/itbranschen.com\/?p=27974"},"modified":"2026-07-01T12:48:37","modified_gmt":"2026-07-01T10:48:37","slug":"barracuda-natfiske-microsoft-365","status":"publish","type":"post","link":"https:\/\/itbranschen.com\/sv\/barracuda-natfiske-microsoft-365\/","title":{"rendered":"Legitim Microsoft-inloggning utnyttjas i n\u00e4tfiskekampanj"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Angripare anv\u00e4nder riktiga Microsoft\u2011inloggningar, d\u00f6ljer n\u00e4tfiskel\u00e4nkar i PDF\u2011bilagor och anv\u00e4nder olika metoder f\u00f6r att kringg\u00e5 s\u00e4kerhetskontroller i e\u2011postmilj\u00f6er. Det framg\u00e5r av Barracuda Networks senaste Email Threat Radar-rapport som beskriver flera aktuella attacker mot organisationer och deras medarbetare.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En av de attacker som beskrivs inneb\u00e4r att angripare anv\u00e4nder Tycoon 2FA, en plattform f\u00f6r n\u00e4tfiske som tj\u00e4nst, och en legitim Microsoft\u2011inloggningssida i st\u00e4llet f\u00f6r en falsk kopia. Syftet \u00e4r att f\u00e5 anv\u00e4ndaren att logga in och d\u00e4rigenom f\u00e5nga upp sessionstoken och beh\u00f6righeter, vilket kan ge \u00e5tkomst till mejl, filer och Microsoft 365\u2011tj\u00e4nster.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Attacken inleds med ett mejl som varnar f\u00f6r att inkorgen \u00e4r n\u00e4ra att bli full. Meddelandet inneh\u00e5ller en kalenderinbjudan till ett p\u00e5st\u00e5tt m\u00f6te med Microsofts s\u00e4kerhetsteam samt en knapp f\u00f6r att frig\u00f6ra kvarh\u00e5llna mejl.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Knappen leder till en Microsoft\u2011inloggning som \u00e4r \u00e4kta, men som n\u00e5s via angriparnas egen registrerade applikation i Tycoon 2FA\u2011plattformen. N\u00e4r anv\u00e4ndaren loggar in f\u00e5ngas sessions-ID upp. I n\u00e4sta steg uppmanas anv\u00e4ndaren att ange sina uppgifter p\u00e5 en falsk sida, vilket g\u00f6r att angriparna ocks\u00e5 kan f\u00e5 tillg\u00e5ng till l\u00f6senordet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>L\u00e4nkar d\u00f6ljs i PDF\u2011bilagor<br><\/strong>Rapporten beskriver \u00e4ven attacker d\u00e4r misst\u00e4nkta l\u00e4nkar har flyttats fr\u00e5n mejlets br\u00f6dtext till en PDF\u2011bilaga.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I den analyserade kampanjen uppmanas mottagaren att \u00f6ppna en bilaga som r\u00f6r exempelvis regelefterlevnad eller betalningar. L\u00e4nken i dokumentet leder till en autentiseringsprocess som liknar en legitim inloggning och samlar in anv\u00e4ndaruppgifter och e\u2011postadress.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I dessa fall genereras enhetskoder lokalt i webbl\u00e4saren i st\u00e4llet f\u00f6r att anv\u00e4nda riktiga Microsoft\u2011API:er. Det efterliknar den process som anv\u00e4nds f\u00f6r att koppla enheter till Microsoft\u2011konton. Bedr\u00e4gerikampanjen anv\u00e4nder \u00e4ven CAPTCHA samt n\u00e4tfiskesidor som upph\u00f6r att fungera efter en viss tid.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Knapp med tv\u00e5 olika utfall i samma mejl<br><\/strong>En annan attack anv\u00e4nder en s\u00e5 kallad \u201dsplit-click\u201d-teknik, d\u00e4r en och samma knapp f\u00e5r olika funktion beroende p\u00e5 var anv\u00e4ndaren klickar.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I det observerade fallet leder ett klick p\u00e5 den \u00f6vre delen av knappen till en legitim Microsoft\u2011sida, medan den nedre delen leder vidare till en n\u00e4tfiskesida via en s\u00e5 kallad blob\u2011URL som genereras i webbl\u00e4saren.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>N\u00e4tfiske anv\u00e4nds ocks\u00e5 f\u00f6r att sprida skadlig kod<br><\/strong>Enligt rapporten anv\u00e4nds n\u00e4tfiske i vissa fall \u00e4ven f\u00f6r att leverera skadlig kod, ut\u00f6ver att samla in inloggningsuppgifter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Bland exemplen som lyfts fram finns:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>filer som framst\u00e5r som ofarliga PDF\u2011dokument men som i sj\u00e4lva verket inneh\u00e5ller ett JavaScript d\u00e4r skriptet d\u00f6ljer sin skadliga kod i det falska dokumentet med hj\u00e4lp av steganografi och tekniker f\u00f6r att maskera koden<\/li>\n\n\n\n<li>kampanjer d\u00e4r angripare utger sig f\u00f6r att vara en myndighet och distribuerar skript som h\u00e4mtar ytterligare kod och k\u00f6r den i minnet med hj\u00e4lp av Windows\u2011komponenter<\/li>\n\n\n\n<li>attacker i flera steg d\u00e4r anv\u00e4ndaren leds via flera sidor, till exempel fr\u00e5n en HTML\u2011fil till en falsk OneDrive och vidare till en inloggningssida<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Rekommendationer fr\u00e5n Barracuda<br><\/strong>I rapporten lyfter <a href=\"https:\/\/itbranschen.com\/tag\/barracuda-networks\/\" data-type=\"post_tag\" data-id=\"16\">Barracuda<\/a> fram f\u00f6ljande \u00e5tg\u00e4rder:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>skydda identiteter och sessions-ID, inte enbart l\u00f6senord<\/li>\n\n\n\n<li>ut\u00f6ka f\u00f6rm\u00e5gan att uppt\u00e4cka hot till att omfatta kalenderinbjudningar, bilagor och inloggningsfl\u00f6den<\/li>\n\n\n\n<li>anv\u00e4nd beteendebaserad detektion<\/li>\n\n\n\n<li>investera i skydd f\u00f6r bilagor och klienter<\/li>\n\n\n\n<li>m\u00f6jligg\u00f6r snabb incidentrespons<\/li>\n\n\n\n<li>uppdatera utbildningar s\u00e5 att de speglar aktuella n\u00e4tfiskemetoder<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Rapporten bygger p\u00e5 analyser fr\u00e5n <strong><a href=\"https:\/\/www.barracuda.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">Barracuda<\/a><\/strong> Research.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/blog.barracuda.com\/2026\/06\/29\/email-threat-radar-june-2026\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>L\u00e4s mer h\u00e4r\u00bb<\/strong><\/a><\/p>\n\n\n\n<section hidden aria-hidden=\"true\" style=\"display:none!important;visibility:hidden!important;opacity:0!important;height:0!important;overflow:hidden!important;position:absolute!important;left:-9999px!important;\">\n  <h2>Barracuda varnar f\u00f6r nya n\u00e4tfiskeattacker mot Microsoft 365<\/h2>\n  <p>\n    Barracuda Research beskriver aktuella cyberattacker d\u00e4r angripare anv\u00e4nder Tycoon 2FA, n\u00e4tfiske som tj\u00e4nst, legitima Microsoft-inloggningar, PDF-bilagor och avancerade phishingfl\u00f6den f\u00f6r att stj\u00e4la sessions-ID, sessionstoken, l\u00f6senord och \u00e5tkomst till Microsoft 365.\n  <\/p>\n  <p>\n    Artikeln handlar om cybers\u00e4kerhet, e-posts\u00e4kerhet, identitetsskydd, Microsoft 365-s\u00e4kerhet, MFA, tv\u00e5faktorsautentisering, phishing, n\u00e4tfiske, skadlig kod, malware, bilagebaserade attacker, blob-URL, CAPTCHA, OneDrive-bedr\u00e4gerier, incidentrespons och beteendebaserad hotdetektion.\n  <\/p>\n  <p>\n    Relaterade s\u00f6kord: Barracuda, Barracuda Networks, Barracuda Research, Microsoft, Microsoft 365, Tycoon 2FA, phishing as a service, PhaaS, cyberhot, IT-s\u00e4kerhet, cybers\u00e4kerhet, Zero Trust, session hijacking, credential theft, e-postattacker, PDF phishing, malware, IT-Branschen, IT Branschen, ITBranschen, IT-Kanalen, IT Kanalen, ITKanalen, IT Media Group, Computer Sweden, CIO Sweden, CSO, TechSverige, CRN Sverige, nordiska IT-nyheter och cybersecurity news.\n  <\/p>\n<\/section>\n","protected":false},"excerpt":{"rendered":"\u200b\ufeffAngripare f\u00e5ngar upp Microsoft 365-sessions-ID och l\u00f6senord via \u00e4kta inloggningar i en phishingkampanj som g\u00f6mmer l\u00e4nkar i PDF-filer och anv\u00e4nder sofistikerade tekniker f\u00f6r att undg\u00e5 s\u00e4kerhetskontroller.\ufeff\u200b","protected":false},"author":1,"featured_media":27979,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","csco_post_video_location":["large-header","archive"],"csco_post_video_location_hash":"41y8sj2ho0imr1yakz4","csco_post_video_url":"https:\/\/www.youtube.com\/watch?v=EyLEZgXipMc","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"footnotes":""},"categories":[21,11],"tags":[1276,16,1431,3207,3157,6028,6514,7164,6007,1134,1725,31,6029,7165,1082,2083,6594,6583,1013,1768,2916,6122,751,1589,1097,1391,6020,7163,129,935,25,974,6095,7166,2329,5629,7160,7158,14,2386,7161,7162,1135,2113,262,7145,1860,7159,1172],"itb_content_type":[],"class_list":["post-27974","post","type-post","status-publish","format-standard","has-post-thumbnail","category-nyheter","category-cybersakerhet","tag-barracuda","tag-barracuda-networks","tag-barracuda-research","tag-cio-sweden","tag-computer-sweden","tag-computersweden","tag-crn-sverige","tag-cso","tag-cyber-security-news","tag-cyberhot","tag-cyberresiliens","tag-cybersakerhet","tag-cybersecurity-news","tag-digi","tag-e-postsakerhet","tag-enterprise-security","tag-hotdetektion","tag-identitetsskydd","tag-incidentrespons","tag-it-branschen-2","tag-it-kanalen-2","tag-it-media-group","tag-it-branschen","tag-it-kanalen","tag-it-sakerhet","tag-itbranschen","tag-itkanalen","tag-javascript","tag-malware","tag-mfa","tag-microsoft","tag-microsoft-365","tag-microsoft-security","tag-microsoft-security-news","tag-natfiske","tag-nordic-it-news","tag-onedrive","tag-pdf","tag-phishing","tag-sakerhetsutbildning","tag-sessions-id","tag-sessionstoken","tag-skadlig-kod","tag-steganografi","tag-techsverige","tag-telekom-idag","tag-tvafaktorsautentisering","tag-tycoon-2fa","tag-zero-trust","cs-entry","cs-video-wrap"],"_links":{"self":[{"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/posts\/27974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/comments?post=27974"}],"version-history":[{"count":0,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/posts\/27974\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/media\/27979"}],"wp:attachment":[{"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/media?parent=27974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/categories?post=27974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/tags?post=27974"},{"taxonomy":"itb_content_type","embeddable":true,"href":"https:\/\/itbranschen.com\/sv\/wp-json\/wp\/v2\/itb_content_type?post=27974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}