Fake Office 365 Phishing Kit Targeted C-Suite Executives Worldwide

Attackers ran a credential-theft campaign that impersonated Office 365 password-expiration notices to target CEOs and other senior executives across manufacturing, real estate, finance, government, and technology organizations. The operation used more than 300 compromised URLs and reused hijacked infrastructure and stolen credentials to reach victims in the United States, Japan, the UK, Canada, Australia, and parts of Europe, with lures tailored to high-value corporate personnel.

Researchers found the campaign relied on a commercially sold Office 365 phishing kit identified as version 4, which included credential validation, anti-analysis blocklists, bot detection, and license-verification features. Misconfigured phishing pages exposed kit files and logs containing stolen victim data and redirection details, while test traffic linked to IP addresses in Morocco offered possible attribution clues; the emails were commonly sent through FireVPS RDP infrastructure, and underground forum activity showed active sales of both the phishing kit and compromised executive account credentials.