Phishing Campaigns Exploit Microsoft Services, Target Global Sectors

Cybercriminals have developed increasingly sophisticated phishing and malware campaigns targeting Microsoft 365 users and macOS customers by exploiting advanced techniques to bypass multi-factor authentication and deceive users with highly legitimate-looking URLs and applications. One notable attack abuses Active Directory Federation Services (ADFS) to generate trusted Microsoft login URLs that redirect victims to phishing sites capturing credentials and session cookies, effectively bypassing MFA protections. Another campaign employs counterfeit Microsoft OAuth applications impersonating well-known brands like Adobe and DocuSign to conduct attacker-in-the-middle phishing attacks, with a success rate exceeding 50% and targeting various industries including aerospace and defense. Additionally, a new Phishing-as-a-Service platform called Salty 2FA targets US and European organizations using multi-stage obfuscation and complex domain redirections to steal credentials and intercept 2FA codes across multiple delivery methods. macOS users face threats from SHAMOS malware delivered via malicious help websites promoted through malvertising, tricking victims into running harmful terminal commands. Meanwhile, attackers use homograph attacks embedding lookalike characters in URLs to fool even vigilant users, exemplified by phishing targeting Booking.com customers with URLs crafted to appear legitimate but leading to malware installations.