ATTACKERS EXPLOIT LINK-WRAPPING SERVICES TO STEAL MICROSOFT 365 LOGINS

Summary from the TLDR InfoSec newsletter

Cloudflare's Email Security team observed a new campaign in which threat actors abuse link-wrapping services from Proofpoint and Intermedia to phish users for Microsoft 365 credentials. Attackers abused Proofpoint link-wrapping in various ways, including multi-tiered redirect abuse with URL shorteners via compromised accounts. In the Intermedia campaign, threat actors sent a message impersonating a “Zix” secure message notification or a Teams notification that would redirect users to a fake login page to harvest Teams credentials.