Phishing Attacks Abuse Microsoft 365 to Bypass Security Filters

Researchers at Guardz report a phishing campaign that compromises multiple Microsoft 365 tenants and weaponizes the tenant display name/organization name field to insert phishing lures into legitimate-looking transaction notifications; recipients are instructed to call a fraudulent support number, enabling social engineering that leads to business email compromise, credential theft, or installation of stealer malware.