NESPRESSO DOMAIN SERVES UP STEAMY CUP OF PHISH, NO CREAM OR SUGAR

Summary from the TLDR InfoSec newsletter

A phishing campaign is exploiting a bug in Nespresso's website to bypass detection by security tools that fail to identify malicious nested or hidden links. The attack begins with a phishing email about Microsoft sign-in activity. Clicking the link directs victims to a legitimate but compromised Nespresso URL, which delivers a fake Microsoft login page designed to steal credentials, all while evading security warnings due to the use of the Nespresso address.