Phishing Campaign Exploits Microsoft Login for Corporate Account Compromise

• •Attackers used Microsoft's genuine login screen to bypass traditional phishing defenses.
• •Over 200 phishing emails targeted 120 organizations across multiple industries.
• •The campaign is no longer active, but attackers have evolved their tactics significantly.

A recent phishing campaign has targeted over 120 organizations by using Microsoft's legitimate sign-in screen to compromise Outlook, SharePoint, and OneDrive accounts. The attackers sent emails disguised as Microsoft Teams notifications from HR, urging users to approve app permissions. This technique bypasses traditional phishing defenses, as the login page appears authentic. Researchers from Check Point identified more than 200 unique phishing emails sent between late June and July 2026. Although the campaign is no longer active, it highlights a significant shift in phishing tactics, moving from fake pages to legitimate authentication systems. Continuous vigilance is advised as attackers adapt their methods. The campaign affected various industries, including legal and healthcare.