As many of the US organizations targeted are also multinational corporations, some 500,000 workers worldwide could have been compromised.

A sophisticated phishing campaign has emerged, targeting employees across various US organizations with fraudulent emails.

Over 3,370 emails have reached more than 350 organizations, primarily in the US, affecting over a million mailboxes.

Victims have included community groups, universities, news outlets, health information organizations, and arts and culture entities, highlighting the broad reach of this cyber threat.

Modus operandi
Working along the lines of past phishing campaigns, the scheme works by exploiting a commonly used platform for its victim base: in this case, a customer relationship management tool used by approximately 500,000 organizations globally — Microsoft’s Dynamics 365 Customer Voice:

• They send emails from compromised accounts, embedding fake links disguised as legitimate business communications, such as invoices or settlement statements.
• The emails often claim to provide access to voicemails or PDF documents. To enhance credibility, the links direct users to a Captcha test, misleading them into believing the request is authentic. The emails typically focus on financial themes, using subject lines related to payments or closing disclosures to lure recipients. In some cases, attackers embed legitimate links alongside fake ones to further deceive users.
• Victims are then redirected to a counterfeit Microsoft login page designed to steal credentials. The attackers’ goal is to gain unauthorized access to sensitive systems, potentially leading to account manipulation, fund theft, or operational disruptions.

While Microsoft has blocked some of the phishing pages, some emails had likely reached inboxes before mitigation efforts were implemented.

The campaign was uncovered by Check Point. A researcher from their team had noted: “This campaign demonstrates the evolving tactics of cybercriminals, leveraging trusted platforms to deceive users.”

The firm is reminding organizations to educate employees about verifying email origins, particularly those claiming to be from big-brand services, and to adopt advanced email security measures. With AI being exploited by cybercriminals to outwit traditional cybersecurity solutions, workers also need to be kept apprised of the latest tactics and vigilance mindset needed to avoid becoming victims.