Skip to content

Back to the catalog

The ASOS Incident: When Attackers Use the Channels Customers Trust
rapid7.comarticle

The ASOS Incident: When Attackers Use the Channels Customers Trust

Rapid7 analyzes the ASOS incident, in which attackers sent a hostile push notification through ASOS's own mobile app claiming its Snowflake environment was compromised and directing customers to a Telegram channel; ASOS confirmed unauthorized access to third-party customer-communication platforms and possible exposure of names/contact details, while Snowflake denied any platform compromise. The piece argues that abusing a legitimate, trusted app/channel defeats typical phishing-awareness heuristics (odd sender, wrong domain) and makes the case for MDR that correlates identity, SaaS, and cloud-integration activity across providers to catch misuse of legitimate access rather than relying on known-bad indicators.

TL;DR Attackers pushed a fake breach notification through ASOS's own app directing customers to Telegram, prompting Rapid7 to argue that detecting abuse of trusted customer-facing channels requires cross-system MDR correlation rather than classic phishing heuristics.
Open original ↗

Organisations named here

  • ASOS

Technologies named here

  • ASOS mobile app / customer notification system
  • Snowflake environment
  • Third-party customer communication platforms
  • ASOS customer personal data
  • Snowflake
  • Telegram

Techniques named here

  • Calendar-based phishing
  • Misuse of legitimate accounts/integrations/SaaS platforms
  • Follow-on phishing exploiting a disclosed incident

Threat actors named here

  • Unidentified attacker behind ASOS push notification incident

Related in Threat Intel