Phishing campaigns use 'Employee Benefits' lure to intercept Microsoft and Okta logins

This report outlines the O-UNC-037 phishing campaign that uses fake Microsoft sign-in pages and Okta-targeting redirects—hosted across multiple domains and Cloudflare Workers—to steal credentials and session tokens via AitM techniques. The analysis identifies a configurable phishing kit/PhaaS, a Base64-encoded gatekeeper parameter, and provides numerous domains and URL paths as indicators of compromise.