A recent example captured by Avanan in Germany: a company's users received an email, pretending to be a tracking update from FedEx, with a link to xn--sicherheit-schlsseldienst-twc.de. Office 365 anti-phishing tools interpreted the ASCII version as a link that took them to a benign web server in Berlin. When users clicked on the link, however, their desktop browser interpreted the link as its Punycode equivalent, sicherheit-schlüsseldienst.de, which led to a malicious server in Belfast, Ireland.

Avanan's analysis of the attack seems to indicate that the hackers are particularly interested in Office 365 credentials. Almost all instances of this email materialized within corporations that use Office 365 for their corporate email and, the landing page for each of the malicious URLs is a fake Microsoft login which, specifically asks for a business email account.

“With the growth in Office 365 for corporate email, hackers are shifting their focus. The characteristics of this particular attack discloses the hacker's intention to deceive Office 365 users into providing their login credentials,” the blog revealed.

Punycode is a method added to the domain name system in order to support non-ASCII characters within a web URL. The first Punycode phishing attacks used non-ASCII characters to fool end-users into clicking URLs that looked legitimate, but substituted similarly-shaped letters from different alphabets to spoof the site.

The user sees a fake Office 365 login page, which requests their credentials. Once the Office 365 usernames and passwords have been compromised, the hackers can:

• Install malware
• Send emails to other users in the victim's address book, asking them for anything, sending invoices, sending more phishing emails, etc.
• Access the user's OneDrive account, to download files, install more malware, infect files with malware, etc.
• Steal company secrets or other customer information such as customer SSNs, credit card numbers, email addresses, etc.

So far, this is very typical. The user sees “legitimate.com” but the underlying link goes to “malicious.com.” What makes this attack nefarious is that by using Punycode and a flaw in the phish-detection engine, the URL actually goes to TWO different sites, one followed by the malware protection filter and the other followed by the end-user's browser when he or she clicks on it.