Loading story…
Attackers ran a credential-theft campaign that impersonated Office 365 password-expiration notices to target CEOs and other senior executives across manufacturing, real estate, finance, government, and technology organizations. The operation used more than 300 compromised URLs and reused hijacked infrastructure and stolen credentials to reach victims in the United States, Japan, the UK, Canada, Australia, and parts of Europe, with lures tailored to high-value corporate personnel.
Researchers found the campaign relied on a commercially sold Office 365 phishing kit identified as version 4, which included credential validation, anti-analysis blocklists, bot detection, and license-verification features. Misconfigured phishing pages exposed kit files and logs containing stolen victim data and redirection details, while test traffic linked to IP addresses in Morocco offered possible attribution clues; the emails were commonly sent through FireVPS RDP infrastructure, and underground forum activity showed active sales of both the phishing kit and compromised executive account credentials.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers said they had tracked the campaign since May 2020. The operation used fake Office 365 password-expiration emails and compromised URLs to target executives.
A second version of the phishing kit was reportedly released 15 days after the first version. This indicates active development of the kit in mid-2019.
The phishing kit used in the campaign was reportedly first released on July 4, 2019. Trend Micro identified the later observed toolkit as version 4 of this commercially sold kit.
Trend Micro said the related phishing activity was evolving since 2019, preceding the campaign period it later tracked directly. The activity centered on fake Office 365 lures targeting senior corporate personnel.
Trend Micro notified FireVPS that its VPS and RDP services were being used to send phishing emails in the campaign. The emails were commonly sent through FireVPS remote desktop infrastructure before transiting Microsoft Outlook SMTP infrastructure.
By September, URL prefixes used in the campaign shifted from "sg" to alternatives such as "pl," "00," and "ag." This marked another observable evolution in the phishing infrastructure.
By August, phishing landing pages in the campaign began including the keyword "OfficeV4." This reflected a change in the infrastructure or kit branding used in the operation.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers ran an **Office 365 credential-harvesting campaign** that sent "missed voice message" lures through legitimate University of Oxford SMTP servers, helping the emails bypass trust-based defenses and appear credible to recipients. The operation primarily targeted organizations in Europe, with additional activity observed in Asia and the Middle East, and focused on stealing Microsoft 365 credentials through convincing fake login pages. The attack chain used multiple trusted and compromised services to evade detection, including Samsung Canada’s Adobe Campaign **open redirect** capability and compromised WordPress sites that forwarded victims to obfuscated phishing pages. Researchers said the operators continuously rotated redirect infrastructure, created per-victim directories, and used JavaScript-generated, XOR-obfuscated HTML to make the phishing kit harder to detect and analyze; Adobe and Samsung were reported as abused infrastructure providers rather than victims of a software exploit.
Aug 14, 2026
A phishing campaign using the **LogoKit** kit abused open redirect vulnerabilities on trusted services, including Snapchat, to deliver credential-harvesting pages while evading spam filters and security checks. Resecurity said the activity targeted **Office 365** users in the United States and Latin America, relying on trusted-looking redirect chains, compromised web resources, and hosting on platforms such as **Fleek** to make malicious links appear legitimate. The kit dynamically customized phishing pages with victim-specific branding and prefilled email addresses, then exfiltrated credentials through AJAX before redirecting victims to legitimate corporate sites to reduce suspicion. Researchers linked the operation to infrastructure spread across hundreds of domains and impersonating brands including **Bank of America**, **GoDaddy**, **Virgin Fly**, **Firebase**, and **Office 365**, underscoring LogoKit's continued use as a long-running phishing platform.
Aug 14, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026