Crims compromised energy firms' Microsoft accounts, sent 600 phishing emails

Microsoft observed a multi-stage phishing campaign targeting energy-sector organizations where attackers used previously compromised addresses to send SharePoint links that prompt users to enter credentials, enabling account takeover. Compromised accounts were used to create inbox rules (deleting/marking messages), monitor and respond to replies, and send hundreds of follow-on phishing emails to internal and external contacts; attackers also employed MFA tampering and persistence techniques, making simple password resets insufficient.