Incident report: how a phishing campaign revealed BEC before exploitation

Expel analysts triaged a large phishing campaign using Jotform-hosted fake document review pages and a browser extension that bookmarked and opened a credential harvester. Multiple submission alerts (89 reported) were aggregated, and sandboxing revealed credentials were posted to a newly created Canadian domain; Workbench and Defender ATP queries confirmed network submissions for two users and an Azure AD risky sign-in. The incident was escalated, customers were notified, credentials were reset, malicious domains and senders were blocked, and the case highlights the speed attackers move from credential theft to attempted access and the value of layered detection and automation.