Top Phishing Lures and Malicious Email Disguises to Watch Out For

5 Bite-Sized Ways to Improve Your Business Every Week

NinjaOne Newsletter

Join fellow growth-minded MSPs and feed your business with new tips and tutorials delivered straight to your inbox.

Don't miss any promotions, free tools, events & webinars and product updates. Subscribe to receive the NinjaOne Newsletter.

Grow faster. Stress less.

Visit our Resources Center for more MSP content.
Jonathan Crowe      

Protect your clients from this year's scariest scams and creepiest compromises by teaching them how to see through the most common malspam and phishing disguises.

To celebrate Halloween and the last day of Cybersecurity Awareness Month, we're shedding light on two of the most popular disguises criminals are using to sneak their way past defenses and into inboxes. Share these with your clients as a reminder to stay vigilant and what you're hard at work protecting them from day in and day out.

Disguise #1: Office docs encouraging you to enable macros

emotet office doc enable macros lure

What is it?

A classic. The witch or dracula of malspam disguises. Attackers send would-be victims emails with an Office file attachment (typically Word, but sometimes Excel or even Publisher files) or a link to the file. These files are often made to look like invoices or other business-related documents to create a sense of urgency. Inside, attackers have hidden malicious macros that, when enabled, launch a chain reaction of commands that typically results in malware being downloaded from the Internet and executed.

This technique has been around for years, and it continues to see heavy usage from some of the today's most active malware operations, including Emotet — by some measurements, currently the most prevalent malware threat.


48% of malicious email attachments are Office files.

Symantec 2019 ISTR


Why still so common after all these years? The answer is simple: It just works.

What makes this disguise effective?

For one thing, Office documents are such a familiar and ubiquitous part of day-to-day work. In most cases, it's not practical to filter them, and employees rarely think twice about receiving them. Many antivirus and email security tools can also have a difficult time analyzing these files for suspicious macro code, especially if the file is placed inside a zip file or password protected.

What's more, attackers are increasingly raising their game to make the context these files are delivered in more believable. Take, for example, the Emotet gang's nasty trick of stealing email content from its victims and using it to send incredibly deceptive emails to the victim's contacts.

Researchers at Talos describe the tactic by breaking down this real example email below:



The email above illustrates Emotet's social engineering. In this example, we have a malicious email from Emotet, and contained inside the body of the email we can see a previous conversation between two aides to the mayor of a U.S. city.

  1. Initially, Lisa sent an email to Erin about placing advertisements to promote an upcoming ceremony where the mayor would be in attendance.
  2. Erin replied to Lisa inquiring about some of the specifics of the request.
  3. Lisa became infected with Emotet. Emotet then stole the contents of Lisa's email inbox, including this message from Erin.
  4. Emotet composed an attack message in reply to Erin, posing as Lisa. An infected Word document is attached at the bottom.

It's easy to see how someone expecting an email as part of an ongoing conversation could fall for something like this, and it is part of the reason that Emotet has been so effective at spreading itself via email. By taking over existing email conversations, and including real Subject headers and email contents, the messages become that much more randomized, and more difficult for anti-spam systems to filter.

— Emotet is back after a summer break, Talos blog


How to see through the disguise

Because these files can be disguised as anything from invoices to shipping notifications — and because they can even appear to be sent from people the recipients know and trust — the best way to protect yourself is to encourage employees to be suspicious anytime an Office doc encourages them to enable macros. 

In many cases, that's a tell-tale sign that something may not be right.

Emotet threat actors utilize a variety of lures to convince victims enabling macros is necessary, from messages indicating the document was created in a different version of Word to Microsoft licensing or Activation Wizard prompts.

Source: Cofense


Source: Bleeping Computer


If your client operates in an environment where macros are required and common, then encouraging heightened suspicious may not be practical, but if that's not the case, then you can also consider going a  step further and blocking macros from running in Office files from the Internet.


Disguise #2: Office 365 Alerts

What is it?

Attackers love going after Office 365 credentials. They open the door to a world of malicious opportunities, including additional spear phishing and — thanks to how common it is for passwords to be reused — additional access and lateral movement attempts.

Emails often take the form of fake notices from Microsoft, alerting users that they have undelivered messages, or that action is required to continue using their account. Clicking the links provided in these emails typically takes the recipient to a realistic-looking Microsoft sign-in page, where the user is asked to provide their credentials.

Source: Bleeping Computer


Campaigns have also included fake voicemails that are actually HTML attachments. When opened, these files play a brief audio recording then also redirect the recipient to a fake Microsoft landing page, prompting them to enter their password to hear the full voicemail.

Source: McAfee

What makes this disguise effective?

Users are much more likely to trust an email that looks like it was sent from Microsoft than an unknown entity. It's one of the reasons why Microsoft is the most commonly impersonated company in phishing emails.


Microsoft is #1 impersonated brand by phishers, with an average of 222 unique Microsoft phishing URLs popping up every day.



Attackers have adopted the tactic of hosting their fake Microsoft sign-in pages on Azure Blob Storage URLs, which use the domain and a valid certificate from Microsoft. That adds legitimacy to these pages and makes it easier for them to slip past filters.

As this video from a webinar we did with Huntress Labs CEO Kyle Hanslovan shows, attackers can even customize these pages to include the name and company logo of targeted victims, adding even more legitimacy.

How to see through the disguise

Spotting these attempts requires being alert and looking for all the standard phishing giveaways — checking the sender name and address, hovering over links to see the URL before clicking, etc. Ex: One of the landing pages Kyle highlights in the video above is "misocroft" — close enough to Microsoft to pass at a quick glance.

In addition to training users to spot the tell-tale signs of phishing emails, you can also consider creating a rule to alert you or users if an email contains the domain.


Protect Your MSP Business and Keep Your Clients Secure with this Cybersecurity Checklist

Are you checking all the boxes when it comes to securing your MSP? Find out with our comprehensive checklist. Download it here.

5 Bite-Sized Ways to Improve Your Business Every Week

NinjaOne Newsletter

Join fellow growth-minded MSPs and feed your business with new tips and tutorials delivered straight to your inbox.

Don't miss any promotions, free tools, events & webinars and product updates. Subscribe to receive the NinjaOne Newsletter.