Back Feeds2.Feedburner

Attackers are using Microsoft’s legitimate login system to camouflage phishing attacks

Feeds2.Feedburner •Sinisa Markovic • July 30, 2026

Attackers are moving away from fake Microsoft login pages in favor of abusing Microsoft’s own authentication system, letting phishing campaigns slip past the warning signs employees are trained to spot, according to Check Point. Between June 25 and the second week of July, researchers found over 200 phishing emails targeting around 120 organizations in a wide range of industries and countries. The email masquerades as a Microsoft Planner task-assignment notification, claiming that HR has shared … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits Microsoft Login for Corporate Account Compromise A recent phishing campaign has targeted over 120 organizations by using Microsoft's legitimate sign-in screen to compromise Outlook, SharePoint, and OneDrive accounts. The attackers sent emails disguised as Microsoft Teams notifications from HR, urging users to approve app permissions. This technique bypasses traditional phishing defenses, as the login page appears authentic. Researchers from Check Point identified more than 200 unique phishing emails sent between late June and July 2026. Although the campaign is no longer active, it highlights a significant shift in phishing tactics, moving from fake pages to legitimate authentication systems. Continuous vigilance is advised as attackers adapt their methods. The campaign affected various industries, including legal and healthcare. 3 sources 69

Extracted Entities

Attackers are using Microsoft’s legitimate login system to camouflage phishing attacks

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)