Widespread phishing campaign targets passwords

As reported in the NCSC’s Weekly Threat Report at the end of last week, Microsoft has warned Office365 customers of a widespread credential phishing campaign using open redirector links.

Attackers use these links alongside social engineering techniques in emails. The links redirect victims to a legitimate Google reCAPTCHA page leading to a fake login page where credentials are then stolen.

The Microsoft 365 Defender Threat Intelligence Team has published a blog on the issue.