Hackers Have Exploited The Queen’s Death

Hackers are taking advantage of the outpouring of condolences for the late British monarch Queen Elizabeth II to launch a phishing attack and surreptitiously gain access to the Microsoft accounts of unsuspecting victims, cybersecurity researchers at Proofpoint revealed.

During this period following the death of Her Majesty the Queen, including her Lying-in-State and State Funeral, there has been an increase in phishing emails and other scams. Threat actors have been capitalising on the death of Queen Elizabeth II to lure targets into clicking on phishing links that request Microsoft credentials. 

Experts at Proofpoint posted a screenshot that revealed the phishing emails appear as though they are being sent from the tech giant itself. The headline claims to pay tribute to the late Queen Elizabeth with an interactive AI memory board.

Proofpoint identified a credential phishing campaign using lures related to Her Majesty Queen Elizabeth II. Messages purported to be from Microsoft and invited recipients to an “artificial technology hub” in her honor. With the headline “In Memory of Her Majesty Queen Elizabeth II,” it claimed that Microsoft is launching an “interactive AI memory board” in her honor and needs “the assistance of our users” to make it work.

To take part in the ‘Elizabeth II Memory Board’ the recipient is urged to click on a button embedded in the email, which will take them to a page prompting them to enter their email credentials. It also features a capability to bypass multi-factor authentication (MFA), Proofpoint warned.

“EvilProxy is a #MITM [man-in-the-middle] phishing framework that uses a reverse proxy to customize landing pages for each recipient and collect credentials and bypass #MFA protection,” Proofpoint said of the infrastructure used to deploy the campaign. “The kit is relatively new and is available for sale on exploit forums.”

However, to take part in the fraudulent memory board, users must click the link embedded in the email. This link takes users to a phished site that prompts users to enter their Microsoft credentials. The site also features a capability to bypass multi-factor authentication, according to Proofpoint.

Major news stories are typically capitalised by threat actors to lure victims into falling for phishing schemes. In this case, instead of inducing urgency, the phishers are capitalizing on grief, concern, and sadness brought on by the Queen’s death.

These themes could continue to pop up in various phishing campaigns and cyber security risks as threat actors continue to find new ways to lure victims.

The phishing campaign was spotted a day after the UK's National Cyber Security Centre (NCSC) warned there might be an increase in phishing emails and other scams related to the queen during national mourning and the UK’s National Cyber Security Centre warned users to expect a surge in phishing attempts related to the Queen’s death.

Proopoint:     NCSC:     Oodaloopp:     Threat Insight:      VPN Review:     Microsoft: 

You Might Also Read: 

Microsoft Warning - Windows Flaw Being Attacked: