Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries

Microsoft disclosed a multi-stage credential-harvesting phishing campaign (Apr 14–16, 2026) that targeted >35,000 users across ~13,000 organizations using polished code-of-conduct lures, PDFs with links, CAPTCHA-gated intermediary pages and AiTM phishing to capture credentials and tokens (bypassing MFA); the report also outlines Q1 2026 phishing trends including a surge in QR-code phishing, widespread use of PhaaS platforms (Tycoon 2FA, Kratos, EvilTokens) and abuse of Amazon SES to evade email authentication.