Adventures in Phishing Email Analysis

This report analyzes a credential-harvesting phishing campaign that used Firebase-hosted fake OWA pages and embedded JavaScript keylogging to capture user credentials; investigators recovered an exposed file containing harvested credentials, confirmed Office 365 mailbox compromises for affected users, monitored ongoing campaign activity across multiple countries, and attempted responsible disclosure and takedown.