Hidden credential phishing within EML attachments · Blog · Sublime Security

Sublime's Attack Spotlight describes an in-the-wild credential-phishing campaign targeting Microsoft 365 users where malicious EML attachments render fake Teams meeting invites that redirect victims through an open redirect and Cloudflare Turnstile CAPTCHA to a spoofed Microsoft login page; the report details attack characteristics, detection signals (suspicious EML content, short body, VPS sender), and links to MQL detection rules used to block these messages.