GTconsult - Blog #Malware

How to spot a 'Phishing' email and Keep Your Business Safe

Wed, 11 Jun 2025 10:19:43 +0000

Watch Out: Think before you click

Phishing attacks have become increasingly deceptive— if you're not careful, it's easy to fall for one. Some prey on our tendency to skim emails, rely on visual cues like familiar logos or jargon, or respond hastily to anything marked as urgent. They’re not always complex— many are simple, but just convincing enough to earn your trust if you’re not paying attention.

Received something like this before?

Or maybe you've received a variation with subjects like:

"Your Zoom account is suspended"
"You missed a Zoom meeting"
"New Zoom message received"

Whatever variation you have (or have not received), these kinds of emails can be so easy to click on if you are not paying attention.

To answer the question,' How do I know if an email is a phishing email or a scam?' Let's have a look at what's wrong with this email that was recently received by one of our team members:

Platform

While this may not apply to all organizations, it's still something to consider. If your organization holds all internal meetings on a different platform (such as Teams). Receiving an email inviting you to a weekly meeting on Zoom might be an immediate red flag. Also, if you notice, it says 'accepted'- be careful not to click the link to find out what exactly you accepted.

Strange sender format

The format (O=EXCHANGELABS/OU=EXCHANGE...), is not how legit Zoom emails are structured.

Zoom emails should come from @zoom.us or @zoom.com- not from an Exchange server's internal address format.

The use of a legit logo to gain trust

When you first click open the email, the first thing that draws your attention is the Zoom logo. It's familiar/recognizable, so if you're skimming through, you may let your guard down and miss all the other red flags.

Suspicious sender email

Always, always, always check the sender email, majority of the time, it's the dead give away that something is fishy...or, you know, phishy.

In this case, the email is not a Zoom domain. It looks like a personal or small org email, which is unusual for a Zoom system-generated message.

Generic language

No meeting title, organizer name, or details. Often, emails like this will also contain urgency without much context.

Real Zoom invites usually include specifics like topic, time, and host name.

File size

This might not always be the case, but it's worth adding to the mix.

Legitimate Zoom or Outlook meeting invites usually include metadata like date, time, location, meeting link, agenda, and possibly attachments or participant info. This often results in a file size larger than 1 KB.

Attackers often use tiny files to avoid detection by email filters and to appear harmless to users.

While .ics calendar invites can be legit, the file size is small (1KB) and may indicate that it is a malicious redirect link or a script meant to exploit vulnerabilities in calendar applications when opened or imported.

Think before you click!

Odd Time

Though this one may not always be the case, coupled with the other clues, it becomes the cherry on top.

Look out for emails coming in after business hours or on the weekends, timezone mismatches or mismatched time stamps.

Other red flags to look out for

The red flags never end, but be on the lookout for poor grammar, punctuation, or formatting.

The takeaway?

Pay Attention. Pay Attention. Pay Attention.

The days of clicking on things without any consequences are long gone (were they ever there?)

The logo might look legit. The meeting title might sound important. But if you don’t slow down to examine the details, you could end up compromising your organization.

Before you click, check:

Who sent it?
What are they asking?
Does this align with how your organization usually communicates?

When in doubt- don’t click. Verify through a different channel.

Want to check if your MS365 Environment is prepared for the just in case?

We recommend getting a penetration test to ensure your organization is well-protected against potential vulnerabilities and attacks. A thorough assessment can uncover weaknesses before cybercriminals do, giving you the opportunity to strengthen your defences and train your team. Don't wait for a breach to take action!

Book a Consultation

Kyle's Take: The recent surge in SharePoint Malware downloads

Tue, 31 Oct 2023 06:54:10 +0000

What the hack is going on?!

A comprehensive write-up on the recent surge in DarkGate Malware – a menacing digital threat that has sent shockwaves through the tech world.

This blog focuses on the malware campaign that has targeted SharePoint, the cause, prevention and cure for such an attack and the measures to take in order to safeguard your digital assets and sensitive information against this pervasive menace.

If you've been keeping an eye on the ever-churning tech rumour mill, you might have come across the unsettling news of a surge in malware downloads linked to a cunning DarkGate malware campaign. This devious scheme tricks victims into unwittingly downloading and opening a malicious LNK file, thereby setting off a chain of infection that culminates in the deployment of the dreaded DarkGate payload.

But this isn't just another rumour – unfortunately, it's a harsh reality that has ensnared numerous individuals and organizations. In recent months, malware downloads in SharePoint have doubled.

What is the cause?

It's just an unusual way of delivering ransomware. These hackers are always trying to find new and exciting ways of getting their horrible, dangerous software in people’s environments. Ever since the rise of work from home, a lot more companies are jumping onto SharePoint as a collaboration platform because of everybody working from home. It's bred the perfect environment for hackers to take advantage. They are taking advantage of the fact that there are a lot of new SharePoint users who aren't as experienced and haven't set up heavy security measures.

So, the issue here is not SharePoint itself, but rather the knowledge on how to keep your platform safe.

What would you say to people who are doubting the safety SharePoint as a collaboration tool?

SharePoint is a phenomenal tool and when you set it up correctly, it can be incredibly secure. It's just about knowing how to set it up correctly. Just make sure you do the correct research going into it or get the advice of people who have a great deal of experience with SharePoint, like us (GTconsult).

How can A Team Protection by GTconsult assist clients in keeping their platform secure?

Microsoft has given us many ways of improving the security for Office 365 and SharePoint, but it very daunting, there are hundreds and thousands of different configurations, policies and alerts that can set up. For an inexperienced staff member to try and find all the right things and all the best practices and put them in place, it's hard.

A lot of companies just don’t have the resources or the skills to get it done.

This is where A Team Protection comes in. We do an overview of your current secure score, go through the list of recommendations that Microsoft gives and work together with you to find the easiest way of implementing changes without causing a problem with user experience.

A Team Protection

When is the best time to do this?

The best time is always now! The sooner, the better. The longer you leave it, the longer you're at risk. Bigger companies are at bigger risk compared to smaller ones. The risk still exists but it’s less than for a company with say, 500 employees.

The attack surface area is far greater and their value as a bigger company makes them a more exciting target for rogue individuals who are looking to make some money.

So, the best time is as soon as possible.

What are the next steps for those who have already fallen victim to the malware?

Organizations who have been victims of this already are on the radar and have been ear marked as a company with weaker security and maybe they've been labelled as an easy target.

If it happens once, there's a higher likelihood that you will become a victim of this type of thing again- unless your security is improved.

And there you have it – a comprehensive response from our expert analyst on the ongoing threat landscape. It's clear that you shouldn't take any chances; don't become the next victim. Instead, reach out to an organization that possesses extensive knowledge in securing platforms like SharePoint. Reach out to GTconsult. With our expertise, we'll proactively assess your security measures before cybercriminals have a chance. Let us fortify your defences before they get the chance to strike. Your data's safety is paramount, and we're here to ensure it.

Let us hack you before you get hacked!

Hack me, Baby!

Keep Reading

Check out our other content below:

Read Me