Microsoft Sextortion Scam Explained: No, They Don’t Have Dirt on You

Clever Tactics: Hackers Exploit Microsoft 365 Admin Portal for Sextortion Scams

Cybercriminals have devised an ingenious method to bypass spam filters and deliver sextortion emails directly to unsuspecting inboxes by exploiting the Microsoft 365 Admin Portal. They utilize the Microsoft 365 Message Center, a platform typically reserved for legitimate service updates, to disseminate their deceptive messages. By leveraging its “Share”feature, these hackers create the illusion that their communications are genuine updates from Microsoft.

The Sextortion Scheme Unveiled

The content of these scam emails is unsettling; they often claim that your device has been compromised and that the sender possesses incriminating material—such as videos or images of you in sensitive situations. The fraudsters demand payment in Bitcoin while threatening to release this alleged material if their demands are not met. The use of a legitimate Microsoft email address adds a layer of authenticity, making the threats appear more credible.

Bypassing Security Measures

What sets these emails apart is their ability to slip past traditional email security measures. Typically, such scams would be detected and flagged by spam filters. However, since these messages originate from a verified Microsoft address, specifically o365mc@microsoft.com, they evade detection. This clever manipulation of trust adds a significant level of danger to the situation.

Exploiting Technical Vulnerabilities

The attackers have taken advantage of the “Personal Message”field within the Microsoft 365 Message Center’s sharing capabilities. Designed to allow short explanatory notes, this field usually supports a maximum of 1,000 characters. However, hackers have found a way to manipulate the maxlength attribute in the HTML textarea element using browser developer tools, enabling them to exceed this limit. Consequently, they can include lengthy sextortion messages that are processed and sent without any truncation.

Security Oversights and User Awareness

This situation raises serious concerns regarding Microsoft’s security protocols, as it undermines the fundamental cybersecurity principle of “Never trust user input.”The reliance on client-side validations, such as character limits, proves to be insufficient when server-side checks are absent. Thus, the email system unwittingly processes and sends the modified scam messages.

Recognizing the Threat

Despite the clever tactics employed by these scammers, it is crucial for users to recognize these emails as fraudulent attempts. As reported by Bleeping Computer, Microsoft is currently investigating this serious issue. However, no effective server-side preventive measures have yet been implemented to combat this abuse.

The Rise of Advanced Sextortion Scams

A disturbing example of a sextortion email was recently shared on the Microsoft Answers forum, wherein the message contained strange symbols as well as personal information like the recipient’s birthdate, enhancing its credibility. The email threatened the release of purported inappropriate footage unless a Bitcoin payment was made within 48 hours.

While sextortion schemes are not new, they have evolved into more sophisticated operations. A significant segment of these scams is orchestrated by notorious groups, such as the “Yahoo Boys”from West Africa, who are known to share instructional guides on platforms like TikTok and YouTube, specifically targeting teenagers and young adults on social media platforms like Instagram and Snapchat.

Source & Images