Loading story…
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with Exchange.ManageAsApp and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments.
Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
Zscaler said it had monitored an active voicemail-themed phishing campaign since May 2022 targeting users at US-based organizations. The campaign used malicious HTML attachments, personalized redirector URLs, Google reCAPTCHA, and Office 365-themed credential harvesting pages.
Microsoft said a large-scale adversary-in-the-middle phishing campaign had attempted to target more than 10,000 organizations since September 2021. The operation used Evilginx2-style infrastructure to steal passwords and authenticated session cookies and then conduct follow-on business email compromise.
Microsoft observed a fresh spam run in August that used an updated Microsoft-spoofing lure and redirect URL while reusing the same phishing infrastructure and redirection chain from the broader open-redirect campaign.
On July 6, 2020, Zscaler observed connection attempts to secure.ciscovoicemail.cf, a phishing site spoofing Cisco Unity Connection voicemail. The site redirected victims to credential-harvesting pages targeting Office 365, Mimecast, Outlook Web Access, Gmail, Yahoo, and generic login brands.
Zscaler observed an increase in voicemail-themed social engineering attacks in July 2020 targeting end users in large enterprises. The campaign used HTML attachments, JavaScript redirects, reCAPTCHA, and fake login pages to steal credentials.
Zscaler identified multiple phishing domains registered between June and mid-July 2020 for a voicemail-themed credential theft campaign. Many used .xyz domains and recipient-specific URL parameters, with redirects to office.com when parameters were absent.
Zscaler reported that the first sample of a voicemail-themed HTML attachment used in a credential-phishing campaign was observed in the wild on April 21, 2020. The attachment redirected users to phishing sites spoofing services such as Office 365 and other webmail brands.
Spamhaus reported that attackers were abusing compromised Google Workspace accounts to send phishing and scam emails from legitimate organizational domains. It identified more than 450 compromised education domains using Google Workspace and said the abuse extended beyond the education sector.
Cofense reported a phishing campaign impersonating Microsoft Power BI notifications with a 'Weekly Sales Report' lure. Victims were sent to a spoofed Microsoft login page on non-Microsoft infrastructure, and after credential submission the campaign displayed a fake account-verification error.
Microsoft said it took down the malicious application network used in the cloud-tenant spam campaign and notified affected customers with remediation guidance. The company also noted that Outlook.com moved spam from the campaign to junk folders before users could interact with it.
In the Microsoft 365 tenant compromise campaign, attackers used privileged OAuth applications to create inbound connectors and transport rules in Exchange Online, then sent spam that appeared to originate from victim domains. The messages promoted deceptive sweepstakes offers intended to trick recipients into entering credit card details for recurring paid subscriptions.
Microsoft investigated a campaign in which attackers used credential stuffing against privileged Microsoft 365 and Azure AD accounts that lacked MFA. After gaining access, they registered malicious single-tenant OAuth applications and granted them Exchange.ManageAsApp and high-level administrative roles for persistence.
Microsoft tracked a widespread credential phishing campaign that abused open redirector links on legitimate domains and used CAPTCHA-gated fake sign-in pages to steal credentials. Microsoft observed at least 350 unique phishing domains and published indicators and hunting guidance for the operation.
Microsoft, MSTIC, and multiple cloud security teams coordinated to report abuse tied to the BEC operation, and cloud security teams suspended offending attacker accounts. This action resulted in the takedown of the cross-cloud attacker infrastructure.
Microsoft researchers uncovered a large-scale business email compromise operation that used phishing to steal mailbox credentials and then created malicious forwarding and deletion rules to exfiltrate finance-related emails. The operation affected hundreds of compromised mailboxes across multiple organizations and used cloud-hosted infrastructure and automation tools such as EmailRuler.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecofense.com
Open sourcezscaler.com
Open sourcezscaler.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026
A widespread phishing campaign is compromising **Microsoft 365** accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked **Storm-2755** (also known as **Payroll Pirates**), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows. Reporting also shows the intrusions can progress without additional device compromise, shifting instead into **identity-plane lateral movement** inside **Entra ID** and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through **Microsoft Graph**, register a malicious Entra ID application, create a service principal, grant permissions such as `Mail.Read` and `Mail.Send`, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including **OfficeHome error 90014**, anomalous Outlook sign-ins with **Firefox** user agents, repeated `SessionID` reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Aug 10, 2026
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026