phishing-campaign-intelligencecredential-access-methoddefense-evasion-methodidentity-authentication-vulnerability

Office 365 Phishing Campaign Abused Oxford, Samsung, and Adobe Infrastructure

Social Engineering & Fraud · 1 source · Updated 3mo ago · First seen Aug 14, 2026

Attackers ran an Office 365 credential-harvesting campaign that sent "missed voice message" lures through legitimate University of Oxford SMTP servers, helping the emails bypass trust-based defenses and appear credible to recipients. The operation primarily targeted organizations in Europe, with additional activity observed in Asia and the Middle East, and focused on stealing Microsoft 365 credentials through convincing fake login pages.

The attack chain used multiple trusted and compromised services to evade detection, including Samsung Canada’s Adobe Campaign open redirect capability and compromised WordPress sites that forwarded victims to obfuscated phishing pages. Researchers said the operators continuously rotated redirect infrastructure, created per-victim directories, and used JavaScript-generated, XOR-obfuscated HTML to make the phishing kit harder to detect and analyze; Adobe and Samsung were reported as abused infrastructure providers rather than victims of a software exploit.

Is your org in this campaign?Get the infrastructure and lures behind it.

Hunt this campaign

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Sep 2019 – Apr 2020

Reported Jun 18, 20206y ago
Campaign expanded redirect infrastructure across multiple WordPress sites
The attackers later broadened the operation to multiple compromised WordPress sites hosting similar redirect paths and altered previously constant URL parameters to evade pattern-based detection.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Reported Jun 18, 20206y ago
Attackers shifted to lookalike Adobe Campaign redirect infrastructure
The operators later changed email links to use the subdomain t-email1.ottawashowers.ca with an /r/ path to mimic Adobe Campaign redirects and reduce dependence on Samsung infrastructure.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Apr 2020
Attack chain routed victims through compromised WordPress sites
The second redirect stage used compromised WordPress sites that only redirected when a specific fragment pattern was present, concealing the abuse from casual visits by site owners.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Apr 2020
Campaign abused Samsung Canada Adobe Campaign redirects
Attackers used an Adobe Campaign redirection mechanism on Samsung Canada infrastructure by modifying parameters in a legitimate campaign URL to send victims to attacker-controlled destinations.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Apr 2020
Attackers abused Oxford SMTP servers to send phishing emails
The campaign sent phishing emails through legitimate University of Oxford SMTP infrastructure using generated addresses on Oxford subdomains, helping messages pass sender reputation checks.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Apr 2020
Office 365 phishing campaign detected
Check Point Research detected an Office 365 phishing campaign in early April 2020. The operation used missed-voice-message lures and targeted organizations primarily in Europe, with additional activity in Asia and the Middle East.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Feb 2020
Samsung USA redirect domain reportedly used for phishing
According to urlscan, the domain t.info.samsungusa.com had been used for phishing-related redirects prior to the campaign described in the report.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research
Sep 2019
Adobe Campaign open redirects previously identified on Adobe domains
The report notes that Adobe Campaign open redirects had been discovered on Adobe-owned domains before this campaign, establishing a known abuse pattern for the redirect mechanism.
Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Affected products

1 linked

Office 365

Organizations

1 linked

Microsoft Corporation

Observables

42 linked

Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

1 reference tracked. Mallory keeps watching after this page renders.

Checkpoint Research BlogNews · Jun 18, 2020

Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point ResearchOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News