Loading story…
Attackers are abusing legitimate Microsoft 365 collaboration features to deliver phishing lures that look like routine internal activity, according to Fortra researchers. The campaign uses attacker-controlled or compromised Microsoft 365 Groups to add victims into spaces named like IT Support, HR Updates, or All Company, then pushes follow-on lures through group mailboxes, shared files, welcome messages, and calendar invitations. Messages are framed around urgent business themes such as payroll, contracts, supplier requests, and mandatory training to blend into normal workplace workflows and lower suspicion.
A key tactic is CalPhishing, in which malicious .ics calendar events are used to place phishing items directly on a victim’s calendar and generate repeated reminders over time. Researchers said the repeated exposure across email, groups, files, and calendar surfaces can make the lure appear to be a legitimate unfinished task, while the end goals include credential theft, token capture, malware delivery, data exposure, and further social engineering. Because the activity is distributed across trusted Microsoft infrastructure, investigations are more complex; defenders were advised to review the full chain of group creation, membership changes, shared content, and lingering calendar entries, and to consider blocking the sender domain groups.outlook.com where appropriate.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Fortra reported a phishing campaign that abuses legitimate Microsoft 365 collaboration features, including Outlook Groups, shared files, group mailboxes, and calendar invitations, to make lures appear like routine workplace activity. The campaign includes CalPhishing techniques using .ics calendar events and repeated reminders to sustain exposure and drive credential theft, token theft, malware delivery, data exposure, or further social engineering.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are abusing Outlook calendar invites in an active **CalPhishing** campaign to hijack Microsoft 365 accounts by delivering malicious `.ics` files that automatically place tentative meetings on victims’ calendars. Researchers at Fortra Intelligence and Research Experts (FIRE) said the invites impersonate urgent administrative notices such as Microsoft 365 domain renewal warnings and digital-signature invoice requests, with manipulated `SUMMARY`, `LOCATION`, and `DESCRIPTION` fields directing users to fake Microsoft 365, GoDaddy, or DocuSign pages. Because the calendar entry can remain visible even if the original email is deleted or sent to junk, the lure continues to generate trusted reminders and increases the chance of user interaction. The campaign uses HTML landing pages and redirect chains through **Cloudflare** to reduce detection, and researchers believe the operators are likely using the **EvilTokens** phishing kit sold on Telegram to automate the attacks. FIRE warned that the activity appears to incorporate **ConsentFix**-style device code phishing to steal session tokens rather than just passwords, allowing attackers to bypass **MFA** and maintain access to compromised accounts. The combination of trusted calendar workflows, persistent invites, and likely AI-assisted automation makes the technique a significant threat to enterprise account security and data privacy.
Jun 29, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026
Threat actors are increasingly abusing workplace collaboration platforms, especially **Microsoft Teams**, to impersonate IT staff, vendors, and support personnel in social-engineering attacks that bypass user trust controls. Palo Alto Networks Unit 42 reported that collaboration-tool phishing accounted for **42%** of all phishing alerts seen in Cortex during the first four months of 2026, up from **30%** in the prior four-month period, showing a broader shift away from traditional email lures. The attacks commonly pressure users to approve multifactor authentication prompts or otherwise grant access, and researchers said both criminal and nation-state actors are using the technique. Cyfirma separately identified an active Teams-themed campaign that uses fake meeting transcript and recording notifications to lure victims to counterfeit landing pages hosted on compromised websites and attacker-controlled cloud infrastructure, including Cloudflare Workers and Pages. Victims are served a signed Windows installer that silently deploys a legitimate remote monitoring and management tool connected to attacker relay servers, then establishes persistence through a Windows service and registry changes, including mechanisms that survive Safe Mode with Networking. The intrusion chain also includes anti-analysis checks and credential theft via a credential provider DLL and an LSA authentication package, indicating the campaign is designed to convert a trusted collaboration message into durable unauthorized access.
Jun 29, 2026