That link carries them to a phishing page where they appear to be entering their credentials so they can change their passwords. Attackers present what looks like a password-expiration notice, using urgent messaging to spur a potential victim into clicking on a malicious link. Once it makes it to inboxes appearing to be a legitimate message, the One Font campaign uses typical phishing social-engineering tactics to get peopleвЂ™s attention. Other techniques that Avanan researchers have observed include redirect tactics like meta refresh that can disrupt NLP and bypass Microsoft SafeLinks, they said.

$tiny font$

Indeed, since the ZeroFont campaign, cybercriminals have gotten increasingly sophisticated in their tactics to slip past the NLP used in common email filters, researchers said. Like that campaign, One Font also targets Office 365 organizations and can lead to BEC and ultimately endanger the corporate network if the messages arenвЂ™t flagged and users are duped into giving up their credentials, researchers said. That campaign inserted hidden text with the font size of zero within messages to trip up email scanners that depend on natural language to weed out malicious emails.

The recent campaign is similar to one Avanan researchers discovered in 2018 called ZeroFont, which used similar tactics to get past Microsoft NLP in its Office 365 security protections. вЂњNatural language filters see random text human readers see what the attackers want them to see.вЂќ вЂњThis breaks semantic analysis, which leads many solutions to treat it as a marketing email, as opposed to phishing,вЂќ Fuchs wrote. The One Font campaign also includes messages with links coded within the tag, which вЂ“ in combination with the other obfuscation techniques вЂ“ also destroy the effectiveness of email filters that depend on natural language for their analysis, according to Jeremy Fuchs, a cybersecurity researcher at Avanan.

Tiny font