Scworld

Phishing Campaign Exploits Microsoft Entra Invitations for TOAD Attacks

First seen 2 Dec 2025, 18:33 UTC • Cyberpress

+1 •79% similarity •10.2

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A new phishing campaign is exploiting Microsoft Entra's guest user invitation system, targeting users with fake invoices related to Microsoft 365. Attackers are using the legitimate '[email protected]' domain to distribute emails that appear to be from Microsoft, tricking recipients into providing sensitive information. This campaign has been identified as a Telephone-Oriented Attack Delivery (TOAD) attack.

ThreatCluster AI

Attack Flow

9 entities, 7 inferred relationships (STIX 2.1).

Technique (2)

Phishing
T1566 - Phishing

Campaign (5)

Telephone-Oriented Attack Delivery
TOAD Attack
TOAD Attacks
TOAD Phishing Attacks
TOAD Phishing Campaign

Organization (1)

Microsoft

Affected Platform (1)

Microsoft Entra

Relationships

Phishing targets Microsoft Entra
T1566 - Phishing targets Microsoft Entra
Telephone-Oriented Attack Delivery related to TOAD Attack
Telephone-Oriented Attack Delivery related to TOAD Attacks
Telephone-Oriented Attack Delivery related to TOAD Phishing Attacks
Telephone-Oriented Attack Delivery related to TOAD Phishing Campaign
Telephone-Oriented Attack Delivery related to Microsoft

Community

Browse all →

Phishing Campaign Exploits Microsoft Entra Invitations for TOAD Attacks

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading