Loading story…
Attackers ran an Office 365 credential-harvesting campaign that sent "missed voice message" lures through legitimate University of Oxford SMTP servers, helping the emails bypass trust-based defenses and appear credible to recipients. The operation primarily targeted organizations in Europe, with additional activity observed in Asia and the Middle East, and focused on stealing Microsoft 365 credentials through convincing fake login pages.
The attack chain used multiple trusted and compromised services to evade detection, including Samsung Canada’s Adobe Campaign open redirect capability and compromised WordPress sites that forwarded victims to obfuscated phishing pages. Researchers said the operators continuously rotated redirect infrastructure, created per-victim directories, and used JavaScript-generated, XOR-obfuscated HTML to make the phishing kit harder to detect and analyze; Adobe and Samsung were reported as abused infrastructure providers rather than victims of a software exploit.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The second redirect stage used compromised WordPress sites that only redirected when a specific fragment pattern was present, concealing the abuse from casual visits by site owners.
Attackers used an Adobe Campaign redirection mechanism on Samsung Canada infrastructure by modifying parameters in a legitimate campaign URL to send victims to attacker-controlled destinations.
The campaign sent phishing emails through legitimate University of Oxford SMTP infrastructure using generated addresses on Oxford subdomains, helping messages pass sender reputation checks.
Check Point Research detected an Office 365 phishing campaign in early April 2020. The operation used missed-voice-message lures and targeted organizations primarily in Europe, with additional activity in Asia and the Middle East.
According to urlscan, the domain t.info.samsungusa.com had been used for phishing-related redirects prior to the campaign described in the report.
The report notes that Adobe Campaign open redirects had been discovered on Adobe-owned domains before this campaign, establishing a known abuse pattern for the redirect mechanism.
The attackers later broadened the operation to multiple compromised WordPress sites hosting similar redirect paths and altered previously constant URL parameters to evade pattern-based detection.
The operators later changed email links to use the subdomain t-email1.ottawashowers.ca with an /r/ path to mimic Adobe Campaign redirects and reduce dependence on Samsung infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers ran a credential-theft campaign that impersonated **Office 365** password-expiration notices to target CEOs and other senior executives across manufacturing, real estate, finance, government, and technology organizations. The operation used more than **300 compromised URLs** and reused hijacked infrastructure and stolen credentials to reach victims in the United States, Japan, the UK, Canada, Australia, and parts of Europe, with lures tailored to high-value corporate personnel. Researchers found the campaign relied on a commercially sold **Office 365 phishing kit** identified as **version 4**, which included credential validation, anti-analysis blocklists, bot detection, and license-verification features. Misconfigured phishing pages exposed kit files and logs containing stolen victim data and redirection details, while test traffic linked to IP addresses in **Morocco** offered possible attribution clues; the emails were commonly sent through **FireVPS RDP** infrastructure, and underground forum activity showed active sales of both the phishing kit and compromised executive account credentials.
Aug 14, 2026
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026