Sophisticated Phishing Campaign Targets Corporate Credentials
Summary: Volexity tracked a series of phishing campaigns impersonating Microsoft Office 365 password-expiration notices, using sender domains closely structured to mimic Microsoft's and white-colored characters inserted between words to evade keyword flagging. Submitted credentials were POSTed to PasswdLogin.php, and Volexity's testing showed automated logon attempts immediately after submission, with three inbox rules later created on a compromised account to hide Microsoft alerts and forward banking and wire transfer emails to a ProtonMail address.
What you should know: The FBI estimated BEC attacks netted criminals upwards of 12 billion US dollars between 2016 and 2018, and this actor's inbox rules quietly forward wire transfer details to an outside address while deleting the alerts that would reveal the compromise.
Read the original at Volexity Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026