Microsoft-Themed Credential Phishing Targets Finance and C-Suite

A credential harvesting campaign observed through February targeted financial controllers, treasurers, C-suite executives, and executive assistants across financial services, insurance, and retail. Unlike broad "spray and pray" operations, the attackers limited their focus to specific individuals at each organization, and in several cases aimed at newly-selected CEOs before public announcements of the transitions were made.

The campaigns, flagged by Area 1 Security, abused Microsoft branding and legitimate-looking infrastructure to bypass native Office 365 defenses and email authentication. The attackers' goal was likely Business Email Compromise (BEC): by compromising financial department accounts, they could access third-party data through invoices and billing, enabling forged invoices to be sent from legitimate addresses to redirect payments to attacker-owned accounts.

Attackers Tailored Lures and Sender Infrastructure

The most common message used the subject "Important Service Changes" with sender display names ranging from generic "no-reply" to company-specific identifiers. Related campaigns used subjects such as "PDF New Policy," "PDF Service," and "Voice Message Received from Unidentified CallerID," sometimes appending the target company's name to the subject line.

To lend legitimacy, the majority of messages were sent from Microsoft-themed sender domains. The operators configured SPF records properly for these domains to help ensure messages passed email authentication checks. Domains were often used in attacks shortly after registration to avoid being flagged as phishing infrastructure before delivery.

In some cases, attackers compromised benign mail accounts or spoofed addresses from poorly configured legitimate domains, exploiting weaknesses in email authentication to evade detection. They also incorporated targets' full names into attachments even when the email address format contained only initials, indicating reconnaissance beyond what was automatically available from the address itself.

Attachment Strategy and Redirect Chain

The phishing emails contained PDF, HTML, or HTM attachments. Microsoft does not proactively send security alerts to end users via this style of email, which should be a red flag, though the enterprise-specific wording risks tricking employees unaware of their organization's actual security update process.

The PDF attachments asked victims to click an "Apply Update" button that led to a spoofed Office 365 login page. Opening the HTML or HTM attachments automatically loaded the credential harvesting site in the victim's browser. The HTML used JavaScript's escape function to conceal the code that, once decoded, relied on HTML "meta" refresh directives to redirect the browser to the phishing page.

Observed redirects included usage of compromised legitimate sites. One link ran through:

hxxps://simpus3.bandungkab.go[.]id/?username=<_base64 encoded target email address_>

which redirected to the credential harvester's landing page. That page displayed a convincing Microsoft-themed privacy policy statement with a subtly photoshopped Microsoft logo. After clicking "Accept," victims were taken to a fake Office 365 login page.

Dynamic Login Page and Phishing Kit Details

The fake login page dynamically loaded the targeted company's logo from logo.clearbit.com based on the domain portion of the victim's email address, matching the branding that would appear on a legitimate sign-in screen. When the victim submitted their password, it was sent via HTTP POST to:

hxxps://microsoftofficeonlineservices[.]outlookprivacypolicy[.]online/common/oauth2-authorize/index[.]php

The phishing kit behind this operation was notably more advanced than typical credential harvesters. The kit: - Verified whether the entered email address was a valid Office 365 address. - Queried for Conditional Access, SSO, or ADFS — when those were present, it redirected the victim to the genuine sign-in experience instead of capturing credentials. - Created different subdomains based on the hardcoded email address in the URL. Changing that address broke the link and redirected to a spoofed Microsoft Service Agreement, the Google homepage, or a blank page. - Used websockets to capture screenshots of each click, Base64-encoding the images via JavaScript when victims clicked "Next" after entering email and password.

This behavior indicates the attacks were aimed at predetermined targets rather than being open to any email address, distinguishing the operation from generic phishing campaigns.

Infrastructure and Hosting Strategy

More than one platform was used to host the credential harvesters. Four Microsoft-themed domains appeared controlled by the attackers:

  • microsoftofficeonlineservices[.]com
  • outlookprivacypolicy[.]online
  • office-policy-center[.]com
  • ms365[.]us

The remaining domains were legitimate websites that had been compromised and repurposed for the phishing operation, a technique that gives attackers the benefit of the sites' positive reputations while reducing the need to purchase trackable infrastructure. Despite the spoofed Microsoft login, many sites stayed active for substantial periods before being flagged, with replacement infrastructure surfacing quickly after each takedown.

Indicators of Compromise

Email subject lines observed: "Important Service Changes," "PDF New Policy," "PDF Service," "Voice Message Received from Unidentified CallerID."

Prevalent sender display names: TOS, Outlook, Notice, Policy, Voicemail, No Reply, no-reply, noreply.

Suspicious sender domains: microsoftoutlookwebservices[.]online, outlookonlinewebservices-com[.]online, microsoftofficeonlinemessagecenter-com[.]ru, entrepreserves[.]com, sollutiance[.]com, unnetflow[.]com.

Compromised hosting sites: al-abdal[.]net, goatourspackage[.]com, perpustakaanarda[.]papua[.]go[.]id, satoshiation[.]com, simpus3[.]bandungkab[.]go[.]id, theeditorngr[.]com.

Malicious file name patterns: _TOS-Updated_v<8-digit number>.pdf, PDF Policy_v<8-digit number>.pdf, _VoiceMessage<8-digit number>.html, Microsoft-Policy-Updated.pdf, PolicyUpdate.htm.