Sophisticated Phishing Campaign Targets Corporate Credentials

Volexity reports on a criminal Business Email Compromise (BEC) campaign that uses convincing Office 365-themed phishing emails and look-alike domains to harvest credentials, automatically validate them, and then create mailbox rules to exfiltrate or hide financial emails; the report includes phishing examples, attacker TTPs, and a list of associated domains and IP indicators.