Microsoft recently uncovered a sophisticated phishing campaign in April affecting users in 26 countries that indicates the use of official-looking lures, multi-step attack chain and legitimate email services to distribute fully authenticated messages from attacker-controlled domains.
The campaign reflects the threat to customer interactions as attackers refine tactics that mimic trusted internal communications and legitimate digital journeys.
According to a blog post by the Microsoft Defender Security Research Team and Microsoft Threat Intelligence:
“Phishing campaigns continue to improve sophistication and refinement in blending social engineering, delivery and hosting infrastructure, and authentication abuse to remain effective against evolving security controls.”
Microsoft Threat Intelligence detected around 8.3 billion email-based phishing threats in the first quarter, according to its quarterly email threat report. By the end of the quarter, QR code phishing emerged as the fastest-growing method of attack, more than doubling over the period, while CAPTCHA-gated phishing evolved rapidly.
Overall, 78 percent of email threats were link-based, whereas malicious payloads accounted for 19 percent of attacks in January and 13 percent in February and March. That indicates the effectiveness of social engineering that tricks victims into clicking on links.
Multi-Step Social Engineering Campaign Leads to Credential Theft
Between April 14-16, the Microsoft Defender Research team observed a series of phishing emails in multiple waves enabling an adversary-in-the-middle (AiTM) attack targeting more than 35,000 users across over 13,000 organizations. Around 92 percent of the users targeted were located in the US, working across a broad range of industries, including healthcare and life sciences, financial services, professional services and technology and software.
The blog post explained the insidiousness of the attack:
"Analysis of the sending infrastructure indicated that the campaign emails were sent using a legitimate email delivery service, likely originating from a cloud-hosted Windows virtual machine. The messages were sent from multiple sender addresses using domains that are likely attacker-controlled."
The emails contained PDF attachments with filenames that suggested the recipient was faced with company disciplinary action. The PDFs contained links that initiated credential harvesting.
The messages appeared legitimate, including notices that they had been “issued through an authorized internal channel” and that links and attachments had been “reviewed and approved for secure access”. A banner stated that the contents had been encrypted using Paubox, a legitimate service associated with communications that comply with US HIPAA regulations.
The design of the attack reflects a growing trend as threat actors are engineering experiences that feel authentic and aligned with how customers expect to receive communication from the companies they interact with.
When Phishing Feels Like a Real Customer Journey
The campaign notably deliberately replicated enterprise-grade communication patterns. Users were guided through a multi-step journey from a polished email with enterprise-style formatting to a PDF attachment mimicking formal documentation, CAPTCHA checks that reinforced perceived legitimacy, staging pages explaining “secure” document access, and a final sign-in flow resembling a standard authentication experience.