www.techradar.com Open in urlscan Pro
151.101.130.114  Public Scan

Form analysis
2 forms found in the DOM

GET https://www.techradar.com/search

<form class="search-box" action="https://www.techradar.com/search" method="GET" data-component-tracked="19">
  <label for="search-input" class="sr-only">Search TechRadar</label>
  <input tabindex="0" type="search" name="searchTerm" placeholder="Search TechRadar" class="search-input" id="search-input">
  <button type="submit" class="search-submit" aria-label="Search">
    <span class="search-icon">
      <svg class="icon-svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000">
        <path d="M720 124a422 422 0 1 0-73 654l221 222 132-131-222-222a422 422 0 0 0-58-523zm-92 504a291 291 0 1 1-412-412 291 291 0 0 1 412 411z"></path>
      </svg> </span>
  </button>
</form>

POST https://newsletter-subscribe.futureplc.com/v2/submission/submit

<form data-hydrate="true" class="newsletter-form__form newsletter-form__form--inbodyContent" method="POST" action="https://newsletter-subscribe.futureplc.com/v2/submission/submit"><input type="hidden" data-hydrate="true"
    class="form__hidden-input form_input form__hidden-input form__hidden-input--inbodyContent" name="NAME"><input type="email" data-hydrate="true" class="form__email-input form_input form__email-input form__email-input--inbodyContent" name="MAIL"
    required="" placeholder="Your Email Address"><input type="hidden" data-hydrate="true" class="form__hidden-input form_input form__hidden-input form__hidden-input--inbodyContent" value="XTP-X" name="NEWSLETTER_CODE"><input type="hidden"
    data-hydrate="true" class="form__hidden-input form_input form__hidden-input form__hidden-input--inbodyContent" value="EN" name="LANG"><input type="hidden" data-hydrate="true"
    class="form__hidden-input form_input form__hidden-input form__hidden-input--inbodyContent" value="60" name="SOURCE"><label class="form__checkbox-label"><input type="checkbox" data-hydrate="true"
      class="form__checkbox-input form_input form__checkbox-input form__checkbox-input--inbodyContent" name="CONTACT_OTHER_BRANDS">Contact me with news and offers from other Future brands</label><label class="form__checkbox-label"><input
      type="checkbox" data-hydrate="true" class="form__checkbox-input form_input form__checkbox-input form__checkbox-input--inbodyContent" name="CONTACT_PARTNERS">Receive email from us on behalf of our trusted partners or sponsors</label><input
    type="submit" data-hydrate="true" class="form__submit-input form_input form__submit-input form__submit-input--inbodyContent" value="Sign me up" required=""></form>

Text Content

WE VALUE YOUR PRIVACY

We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products. With your
permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting.
Please note that some processing of your personal data may not require your
consent, but you have a right to object to such processing. Your preferences
will apply to this website only. You can change your preferences at any time by
returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
Skip to main content
Tech Radar
 * Tech Radar Pro
 * Tech Radar Gaming

Open menu Close menu
Tech Radar Pro TechRadar IT Insights for Business
Search
Search TechRadar
Subscribe
RSS
(opens in new tab) (opens in new tab) (opens in new tab) (opens in new tab)
US Edition


Asia

Singapore

Europe

Danmark


Suomi


Norge


Sverige


UK


Italia


Nederland


België (Nederlands)


France


Deutschland


España

North America

US (English)


Canada

Australasia

Australia


New Zealand

Technology Magazines
Why subscribe?
 * The best tech tutorials and in-depth reviews
 * Try a single issue or save on a subscription
 * Issues delivered straight to your door or device

From€8
View
 * 
 * News
 * Reviews
 * Features
 * Website builders
 * Web hosting
 * Perimeter 81
 * Security




Trending
 * Best standing desk deals
 * Best cloud storage 2023
 * Everything you need to WFH
 * What is Microsoft Teams?
 * Windows 11 for business



When you purchase through links on our site, we may earn an affiliate
commission. Here’s how it works.


 1. Home
 2. News
 3. Computing


HACKERS HAVE FOUND A CLEVER NEW WAY TO STEAL YOUR MICROSOFT 365 CREDENTIALS

By Sead Fadilpašić
last updated April 14, 2022

Static Web Apps are the latest weapon in the scammer arsenal

 * (opens in new tab)
 * (opens in new tab)
 * 
 * (opens in new tab)
 * (opens in new tab)
 * 


(Image credit: Unsplash)

Audio player loading…

Cybercriminals have started using Static Web Apps, an Azure service, in their
phishing attacks against Microsoft 365 (opens in new tab) users.



Researchers from MalwareHunterTeam noted Static Web Apps have two features that
are being abused with ease - custom branding for web apps, and web hosting for
static content such as HTML, CSS, JavaScript, or images.



These features have been used by threat actors to host static landing phishing
pages, the researchers are now saying. These landing pages look almost identical
to official Microsoft services, with the company logo, and the Single SignOn
(SSO) option that harvests Office (opens in new tab) 365, Outlook, or other
credentials.



TechRadar needs yo...

We're looking at how our readers use VPNs with different devices so we can
improve our content and offer better advice. This survey shouldn't take more
than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<




SNEAKY TACTICS

Reporting on the findings, BleepingComputer says using Azure Static Web Apps to
target  Microsoft users is an “excellent tactic”, as each landing page gets its
own secure page padlock in the address bar, due to the *.1.azurestticapps.net
wildcard TLS certificate.

RECOMMENDED VIDEOS FOR YOU...Tech Radar Pro



With such a TLS certificate, even the most suspicious of victims could be
tricked.



It also makes the landing pages good for targeting users on other platforms and
other email providers, as these victims could also be fooled by the fake
security assurance of the legitimate Microsoft TLS certificate.

Usually, when a person is suspecting a phishing attack, they’d check the URL
they’re being invited to click. Using Azure Static Web Apps renders this advice
useless, as many will most likely be fooled by the azurestticapps.net, and think
the identity (opens in new tab) is legitimate, the publication concludes.

> What is phishing and how dangerous is it? (opens in new tab)

> LinkedIn is becoming a paradise for phishing attacks (opens in new tab)

> Phishing attacks hit more businesses than ever last year (opens in new tab)

Azure Static Web Apps Microsoft’s tool that helps developers build and deploy
full stack web apps to Azure, from a code repository.

Its key features include web hosting for static content like HTML, CSS,
JavaScript, and images, integrated API support provided by Azure Functions,
GitHub and Azure DevOps integration, globally distributed static content, free,
automatically renewed SSL certificates, custom domains to provide branded app
customizations, and other. 

Microsoft is silent on the matter, for the time being. 

 * If you're looking to keep your devices secure, make sure to get one of the
   best endpoint protection services right now (opens in new tab)

Via: BleepingComputer (opens in new tab)


ARE YOU A PRO? SUBSCRIBE TO OUR NEWSLETTER

Sign up to theTechRadar Pro newsletter to get all the top news, opinion,
features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on
behalf of our trusted partners or sponsors
By submitting your information you agree to the Terms & Conditions (opens in new
tab) and Privacy Policy (opens in new tab) and are aged 16 or over.
Sead Fadilpašić


Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and
Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity
(ransomware, data breaches, laws and regulations). In his career, spanning more
than a decade, he’s written for numerous media outlets, including Al Jazeera
Balkans. He’s also held several modules on content writing for Represent
Communications.

See more Computing news








MOST POPULARMOST SHARED
 1. 1
    How often do you really need to upgrade your PC?
 2. 2
    Here’s how NVIDIA GeForce NOW is making 2023 the year of cloud gaming
 3. 3
    I revamped my gaming desk to improve my mental health – and it really helped
 4. 4
    This is the best iOS 16 feature you're probably still not using
 5. 5
    Gen Z is getting right what we Millennials got wrong about tech

 1. 1
    Best free email services for 2023
 2. 2
    This is the best iOS 16 feature you're probably still not using
 3. 3
    Huge Samsung Galaxy S23 leak reveals the phone from all angles
 4. 4
    Sky TV customers just got another streaming service thrown in for free
 5. 5
    I'm not ready for the furry flesh spider in this Chinese Elden Ring-like RPG

Technology Magazines
 * ●

 * The best tech tutorials and in-depth reviews

From€8
View


TechRadar is part of Future US Inc, an international media group and leading
digital publisher. Visit our corporate site (opens in new tab).

 * About Us (opens in new tab)
 * Contact Us (opens in new tab)
 * Terms and conditions (opens in new tab)
 * Privacy policy (opens in new tab)
 * Cookies policy (opens in new tab)
 * Advertise with us (opens in new tab)
 * Web notifications (opens in new tab)
 * Accessibility Statement
 * Careers (opens in new tab)

© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.