Figma abuse from compromised vendor used in credential theft attack · Blog · Sublime Security

Sublime Security's Attack Spotlight describes a credential-phishing campaign that used a compromised vendor email and a Figma-hosted link to deliver a fake OneDrive/ RFQ flow, ultimately redirecting victims to a credential-harvesting Microsoft login page (csoaitv.org). The report details the multistage LOTS technique, detection signals observed by Sublime's AI, and guidance on adaptive email security to mitigate these attacks.