Phishers Wreak 'Havoc,' Disguising Attack Inside SharePoint

**Executive Summary:** A sophisticated phishing campaign delivers a ClickFix-style lure via SharePoint-hosted HTML documents that instruct victims to paste a PowerShell command, which then fetches and executes a modified Havoc command-and-control framework; the operator further hides C2 traffic by abusing the Microsoft Graph API and legitimate SharePoint hosting to evade detection.