Active Phishing Campaign Targets Microsoft 365 Users Across Multiple Sectors
A sophisticated phishing campaign has emerged, targeting Microsoft 365 accounts in over 340 organizations across the U.S., Canada, Australia, New Zealand, and Germany. Detected by cybersecurity firm Huntress on February 19, 2026, this attack utilizes device code phishing techniques that exploit legitimate Microsoft services, making it particularly insidious.
Sectors including construction, healthcare, and finance are among those affected, with attackers using a variety of deceptive tactics like impersonating DocuSign and sending fake voicemail notifications. The impact is significant, as compromised accounts allow attackers persistent access, even after passwords are changed.
To safeguard against this threat, organizations should monitor sign-in logs for unusual activity, revoke affected users’ refresh tokens, and block authentication attempts from identified malicious IP addresses.
Risk Level: High
Stay vigilant and ensure robust security measures are in place to protect sensitive information.
Source: View Original Report
