Phishpoint back in full swing: an infamous Microsoft SharePoint spoof resumes with new tactics

This post details a specific phishing campaign targeting Microsoft SharePoint credentials, leveraging new COVID-19 restrictions as a lure. It describes the campaign's tactics, including the use of cloud computing services (Azure, Google Storage, AWS) for hosting credential harvesters, VPS for sending messages, and SendGrid to bypass email authentication and SEGs. The analysis includes the spoofed login page's JavaScript, the method of credential exfiltration, and the error message displayed to victims. It highlights the limitations of traditional defenses against such sophisticated attacks and positions Area 1 Security's ML/AI technology as a solution for real-time, time-zero detection.