WebEx Security Vulnerability
WebEx users and account administrators receive an email stating WebEx has a critical security vulnerability and requires immediate action.
Methods
Payloads
Goals
Description
WebEx users and account administrators receive an email from "WebEx" with details of a new critical CVE (Common Vulnerabilities and Exposures) security flaw that requires immediate patching. The email is HTML-based and mimics the actual Cisco Security Advisory format (see link in the resources section below). In fact, attackers could use an actual security advisory in the email. The email also contains a link to review / fix the security vulnerability that requires users to first log into WebEx, thus providing the attacker an opportunity to harvest credentials.
Example Email(s)
Source: https://www.proofpoint.com/us/threat-insight/post/remote-video-conferencing-themes-credential-theft-and-malware-threats
Example Payload Ideas
Fake WebEx or Cisco VPN login page designed to capture user credentials.
Analysis
Cybersecurity is top of mind for many employees and IT administrators, especially in the age of large-scale remote working. Given all of the attention Zoom received in the spring of 2020 for Zoombombing, it would be reasonable to believe employees would pay extra attention to another teleconferencing service that might have security issues.