New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users

Cybersecuritynews •Tushar Subhra Dutta • June 23, 2026

Phishing attacks have grown more sophisticated, and attackers are no longer relying on clunky fake emails or obvious scam messages. A newly identified campaign shows how threat actors are turning everyday Microsoft 365 tools into weapons, hiding their attacks inside the very workflows employees trust most. This is not a flaw in Microsoft’s software but […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaigns Exploit Microsoft 365 Collaboration Features Cyber attackers are increasingly leveraging Microsoft 365 collaboration tools, specifically Outlook Groups and calendar invites, to execute phishing campaigns. This method disguises malicious activities within routine workflows, making it difficult for users to identify threats. The technique involves sending what appears to be legitimate group additions or calendar updates, which can lead users to take harmful actions. Fortra's Security Engineer, Daud Jawad, highlighted that this approach shifts the focus from a single suspicious email to a more trusted environment, increasing the likelihood of user engagement. As a result, organizations using Microsoft 365 may face heightened risks of falling victim to these sophisticated phishing attempts. The current status indicates a growing trend in such attacks, necessitating increased vigilance among users and IT departments. 3 sources 52

Extracted Entities

New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)