Surge in Phishing Attacks Hijacking Legitimate Microsoft Communications

KnowBe4 Threat Labs observed a large phishing campaign (peaking at ~7,000 messages in a 30-minute window) that abused legitimate Microsoft tenancies and mailflow rules to forward real Microsoft invoice emails containing a maliciously crafted "account name" message asking recipients to call a fraudulently provided phone number. By embedding the social-engineered payload in an organization name and using onmicrosoft.com domains, attackers preserved SPF/DKIM/DMARC authentication to increase deliverability and evade standard defenses; KnowBe4 Defend detected the attack via recipient/address mismatches and linguistic anomalies.