Loading story…
The financially motivated CSuite operation targeted organizations in the United States and Europe with multi-stage phishing campaigns that steal credentials and Microsoft 365 sessions or install legitimate remote-management software for persistent endpoint access. Attackers impersonated trusted services including Adobe, DocuSign, Zoom, SharePoint, Teams, Microsoft 365 voicemail, Dropbox, and Google Meet, using device-code OAuth authentication phishing alongside credential-harvesting pages to bypass conventional password-focused defenses.
Investigators linked the identity-theft and remote-access branches through shared delivery infrastructure, phishing panels, operator accounts, and remote-administration systems. The CSuite v1.1 panel exposed records for 216 Chameleon phishing victims, 29 captured Microsoft 365 sessions, 1,593 Adobe lure documents, and 15,955 harvested email addresses; 60% of identified victims were US-based. The campaign used hijacked Adobe Document Cloud tenants, Cloudflare Workers, public code-hosting services, and tools including ScreenConnect, Action1, Atera, Syncro, and PDQ Connect, enabling business-email compromise, payment fraud, and durable access while rotating infrastructure and applying anti-analysis controls.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
CSuite-related feeds remained active through at least 3 September 2026, confirming the operation continued after the identified infrastructure-linking error.
An operator sent hosting-control-panel credentials and, three hours later, remote-desktop-host credentials to the same recipient. The remote desktop host administered the CSuite v1.1 panel, registrar, and Cloudflare account, linking the delivery and credential-capture infrastructure.
The earliest identified sample associated with the CSuite operation was dated 6 March 2026.
CSuite, a financially motivated phishing, credential-theft, Microsoft 365 session-hijacking, and remote-access operation, was observed targeting organizations beginning in February 2026.
Technical reporting described CSuite as a provider-and-affiliate operation and documented its use of legitimate remote-management tools, credential phishing, session theft, persistence mechanisms, and anti-bot-filtered lure infrastructure. The reporting identified 216 Chameleon victims, 29 captured Microsoft 365 sessions, 1,593 lure documents, and 15,955 collected email addresses, along with victim examples and additional infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 121 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourceany.run
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers ran a credential-theft campaign that impersonated **Office 365** password-expiration notices to target CEOs and other senior executives across manufacturing, real estate, finance, government, and technology organizations. The operation used more than **300 compromised URLs** and reused hijacked infrastructure and stolen credentials to reach victims in the United States, Japan, the UK, Canada, Australia, and parts of Europe, with lures tailored to high-value corporate personnel. Researchers found the campaign relied on a commercially sold **Office 365 phishing kit** identified as **version 4**, which included credential validation, anti-analysis blocklists, bot detection, and license-verification features. Misconfigured phishing pages exposed kit files and logs containing stolen victim data and redirection details, while test traffic linked to IP addresses in **Morocco** offered possible attribution clues; the emails were commonly sent through **FireVPS RDP** infrastructure, and underground forum activity showed active sales of both the phishing kit and compromised executive account credentials.
Aug 14, 2026
Attackers ran an **Office 365 credential-harvesting campaign** that sent "missed voice message" lures through legitimate University of Oxford SMTP servers, helping the emails bypass trust-based defenses and appear credible to recipients. The operation primarily targeted organizations in Europe, with additional activity observed in Asia and the Middle East, and focused on stealing Microsoft 365 credentials through convincing fake login pages. The attack chain used multiple trusted and compromised services to evade detection, including Samsung Canada’s Adobe Campaign **open redirect** capability and compromised WordPress sites that forwarded victims to obfuscated phishing pages. Researchers said the operators continuously rotated redirect infrastructure, created per-victim directories, and used JavaScript-generated, XOR-obfuscated HTML to make the phishing kit harder to detect and analyze; Adobe and Samsung were reported as abused infrastructure providers rather than victims of a software exploit.
Aug 14, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026