author photo
By SecureWorld News Team
Mon | Nov 29, 2021 | 3:11 PM PST

Did you happen to stop by IKEA on Black Friday to raid the sales? At the same time you may have been browsing through assorted home items, an internal cyber attack plagued the retail company's security team. 

Malicious hackers used hijacked reply-chain emails to cause disruption through a phishing attack, according to a story broke by Bleeping Computer

This is what is known so far.

IKEA becomes victim of reply-chain phishing email attack

A copy of an alleged internal email, which warned IKEA's employees about the cyberattack, came into the public's hands.

An unidentified employee explains how the malicious phishing attack preyed on team members responding to reply-all conversations. 

Internal email sent to IKEA employees

An integral part of how the attack played out was also described in the quote below taken from the email. 

"This means that the attack can come via email from someone that you work with, from any external organisation, and as a reply to an already ongoing conversations. It is therefore difficult to detect, for which we ask you to be extra cautious."

A sample of the phishing email was also included in Bleeping Computer's story, which shows the date the hacker began sending these emails was at least October 28th, but possibly earlier. 

Example phishing email sent to IKEA employees

This is not the first time Microsoft Exchange emails have led to this kind of cyberattack. Key indicators of a reply-chain attack are the hacker's ability to compromise servers through stolen chain emails, which trick the users into clicking because they trust the email was sent by someone they already are corresponding with, such as a fellow colleague, supplier, or business associate. 

Hacking campaigns like this one redirect users to download a malicious spreadsheet, which then downloads the Trojan malware onto the user's system. After the user's computer/system is infected, a hacker can compromise the network or even deploy a ransomware attack. 

As more details of this story become available, SecureWorld News will provide an update.

Resource 

Visit SecureWorld's events page to learn more about upcoming conferences and dinners. 

Tags: Phishing, Retail,
Comments