Hackers Exploit YouTube Links & Microsoft 365 Themes to Steal Logins

This report details a phishing campaign targeting O365 users that leverages URL obfuscation (including use of the @ symbol and excessive %20 encoding) and redirector kits (Tycoon 2FA, Mamba 2FA, EvilProxy) to send victims to fraudulent login pages and steal credentials; an example malicious domain (globaltouchmassage.net) is noted and mitigations such as user training, URL filtering, sandboxing, and prompt reporting are recommended.