A US defense and aerospace parts supplier reported that an attacker got into its Microsoft 365 environment after an employee clicked what looked like a legitimate Microsoft file-sharing link. The link led to a fake login page that captured the employee’s credentials, potentially exposing sensitive email, purchase orders, and engineering documentation.
An employee at a defense and aerospace parts supplier received a message from someone posing as a prospective business contact. The message included what appeared to be a legitimate Microsoft file-sharing link, inviting the employee to review shared documents. Clicking the link led to a page designed to look like a real Microsoft sign-in screen, but it was fake. When the employee entered their credentials, the attacker captured them.
With those stolen credentials, the attacker gained access to the company's Microsoft 365 environment, including email, attachments, customer correspondence, purchase orders, and engineering documentation. The company reported that the intruder may also have reached technical information covered by US export controls. The incident was disclosed via an SEC 8-K filing, and the company said it discovered the intrusion in early August.
This attack worked because it relied on trust in a familiar workflow: receiving and reviewing a shared file through Microsoft's ecosystem. The pretext, a prospective business contact sharing a document for review, is a routine business interaction, especially for roles in sales, business development, and program management who regularly onboard new external contacts. Because the link and login page closely mimicked genuine Microsoft branding, the employee had little reason to suspect anything was wrong before entering credentials.
Organizations, especially those in manufacturing and the defense supply chain, should train employees across sales, engineering, program management, and executive support roles to treat unexpected file-sharing links as high risk. Before clicking through and signing in, employees should verify the sender through a separate, known communication channel rather than replying to the original message.
When a link does lead to a sign-in page, employees should pause and confirm it is a legitimate Microsoft authentication page, checking the domain carefully rather than assuming familiar branding means it is safe. Because mailbox access can expose sensitive business data such as purchase orders and engineering documents, any suspicious sign-in prompt or unexpected credential request should be reported immediately so security teams can investigate before broader access is gained.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An employee received a message from someone posing as a prospective business contact that included what looked like a legitimate Microsoft file-sharing link. The link led to a fake login page that captured the employee's credentials, which the attacker then used to access the Microsoft 365 environment.
The intruder could reach email, attachments, customer correspondence, purchase orders, and engineering documentation, and possibly technical information covered by US export controls.
The company reported no evidence that data was copied out, but also noted that Microsoft 365 logging may not reliably capture data theft.
Unexpected file-share links from new or unverified contacts, login pages that look slightly off or unexpectedly prompt for credentials, and pressure to review documents quickly without normal verification steps.
A US defense supplier got breached because of one click on a fake Microsoft file-sharing link. An employee got a message from someone posing as a new business contact, with a Microsoft link to 'review purchase and engineering documents.' They clicked, got a Microsoft 365 login lookalike, signed in, and handed over their credentials. Those stolen credentials unlocked their Microsoft 365: email, attachments, customer correspondence, purchase orders, engineering documentation, exactly the stuff we never want exposed, especially in defense work. Here’s the move: if a new contact sends a Microsoft file link that makes you sign in, stop and verify them using a known, separate channel before you type a single character.
IEH Corporation disclosed that a phishing email tricked an employee into entering Microsoft 365 credentials on a fake login page, giving an attacker access to the employee’s mailbox. The compromised inbox contained emails and attachments including engineering documents and potentially…
Authorities dismantled “Kratos,” a phishing-as-a-service platform used at scale to steal Microsoft account credentials and even bypass MFA by stealing session cookies. The article also describes a real campaign using tax-season lures and personalized QR codes to trick users into visiting fake…
Law enforcement dismantled the infrastructure behind Kratos, a widely used phishing kit that helped criminals steal Microsoft 365 credentials and, in some cases, capture session cookies to bypass MFA. The article describes a real, observed campaign using tax-themed W-2 QR-code emails that led…
German and international law enforcement disrupted the infrastructure behind “Kratos,” a phishing-as-a-service kit used at scale to steal Microsoft account logins. The kit provided convincing Microsoft-themed fake login pages designed to steal passwords and session cookies, which could help…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
