Phishing Campaign Fake Compliance Notices Credential Harvesting | MSSP Advisory

A phishing campaign targeted over 35,000 users across 13,000 organizations using fake workplace compliance notices to steal Microsoft account credentials through fraudulent sign-in pages. The campaign concentrated on US targets and successfully led victims through fake compliance portals to credential harvesting pages that mimicked legitimate Microsoft login interfaces.

Your clients are getting hit with compliance-themed phishing that looks legitimate enough to fool employees who expect compliance communications. If client accounts get compromised because they fell for fake compliance notices and you said nothing, you own that conversation with angry leadership.

📬