IEH Corporation disclosed that a phishing email tricked an employee into entering Microsoft 365 credentials on a fake login page, giving an attacker access to the employee’s mailbox. The compromised inbox contained emails and attachments including engineering documents and potentially export-controlled technical information, creating both security and regulatory risk.
This incident began with a simple phishing email. A threat actor impersonated a prospective business contact and sent a link disguised as a Microsoft document-sharing invitation. The message asked the recipient to review a shared document, a routine-sounding request that many employees in sales, business development, or program management roles receive regularly.
When the employee clicked the link, they were taken to a fraudulent login page designed to look like a legitimate Microsoft 365 sign-in screen. Entering credentials there handed the attacker direct access to the mailbox. From that point, no malware was needed. The attacker simply had the keys to the account.
The attack sophistication here was low, which is part of what makes it worth studying. There was no custom malware, no zero-day exploit, just a convincing pretext and a fake login page. The lure worked because it mimicked a normal business interaction: an external contact sharing a document ahead of a possible conversation. That framing lowers suspicion, especially for roles whose job is to respond to outside inquiries.
Once inside, the attacker created malicious mailbox rules. This detail matters: it suggests the attacker had enough time in the account to set up persistence, potentially to silently forward or hide messages while continuing to monitor the mailbox.
The compromised mailbox contained emails and attachments, including customer data and engineering documents. Some of that material was potentially export-controlled technical information. For a defense manufacturer, that raises the stakes considerably. Export-controlled data exposure is not only a security event, it can also carry regulatory implications depending on how the information was handled and who may have had access to it.
Employees should avoid entering Microsoft 365 credentials after clicking a link in an email. Instead, open Microsoft 365 directly through a bookmark or app and locate shared files from there. Verifying unfamiliar senders through a separate, known-good channel before engaging with a shared-document request adds another layer of protection.
Organizations should also train staff to report unusual mailbox activity immediately, since attacker-created rules can be a sign of ongoing persistence. For organizations that handle controlled technical data, treating any email compromise as a potential compliance issue, and looping in security, legal, and export compliance teams early, helps limit downstream risk beyond the initial account takeover.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A threat actor impersonated a prospective business contact and sent a hyperlink disguised as a Microsoft document-sharing link. The employee clicked it and entered Microsoft 365 credentials into a fraudulent login page, giving the attacker unauthorized account access.
The compromised mailbox contained emails and attachments including customer data and engineering documents, some of which was potentially export-controlled technical information.
According to the disclosure, there was no confirmed data exfiltration at the time the incident was reported, though malicious mailbox rules had been created in the account.
When technical data falls under regulations like ITAR or EAR, unauthorized exposure to an unauthorized party can raise compliance and legal concerns beyond the security impact of the breach itself.
An engineer clicked one “Shared document for review” email… and their inbox with export‑controlled designs was suddenly wide open. They clicked the link, saw a Microsoft 365 login look‑alike, and typed their password. That fake page handed an outsider full access to their mailbox, customer emails, engineering docs, even ITAR and EAR‑sensitive files. Behind the scenes, the intruder set sneaky mailbox rules to quietly grab or hide messages. And all of it started with an unexpected “Microsoft document-sharing” link from a so‑called prospective business contact. Here’s the move: if you get a “shared document” email from a new contact, do NOT log in from that link. Instead, open Microsoft 365 from your bookmark or app, and only open shared files from there.
A US defense and aerospace parts supplier reported that an attacker got into its Microsoft 365 environment after an employee clicked what looked like a legitimate Microsoft file-sharing link. The link led to a fake login page that captured the employee’s credentials, potentially exposing sensitive…
Authorities dismantled “Kratos,” a phishing-as-a-service platform used at scale to steal Microsoft account credentials and even bypass MFA by stealing session cookies. The article also describes a real campaign using tax-season lures and personalized QR codes to trick users into visiting fake…
Law enforcement dismantled the infrastructure behind Kratos, a widely used phishing kit that helped criminals steal Microsoft 365 credentials and, in some cases, capture session cookies to bypass MFA. The article describes a real, observed campaign using tax-themed W-2 QR-code emails that led…
German and international law enforcement disrupted the infrastructure behind “Kratos,” a phishing-as-a-service kit used at scale to steal Microsoft account logins. The kit provided convincing Microsoft-themed fake login pages designed to steal passwords and session cookies, which could help…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
