OneDrive Personal Links in Email Reply Chain Attacks
Since April 2019, there is a new type of attacks that use emails as an attack vector: the so-called Email Reply Chain Attacks. The first step in these attacks is to spy on emails. The responses to these emails written by the criminals contain a malicious link or attachment. While this method was initially used on a larger scale by Emotet, other threats such as QakBot (aka Qbot or also Quackbot) have also been added over time.