Using Genuine Business Domains and Legitimate Services to Harvest Credentials

The KnowBe4 Threat Lab analyzed a targeted phishing campaign active from October 2–3, 2024, which abused a compromised legitimate business domain and Mailgun email services to deliver Microsoft-branded credential-harvesting pages. Attackers created subdomains, leveraged an open redirect vulnerability, and used multiple delivery methods (malicious HTML attachments, QR-containing PDFs, hidden JavaScript, impersonated MS notifications) to bypass security controls and increase click rates; the campaign sent 170+ reported emails primarily to finance and healthcare organizations in the U.S. Recommendations include deploying EDR, monitoring DNS and outgoing email, and strengthening user phishing awareness.