Industry NewsMarketing Automation
Microsoft Flags Global Phishing Attack Targeting Over 35,000 Users
Article content
Microsoft has flagged a large-scale global phishing campaign that targeted more than 35,000 users across over 13,000 organizations in 26 countries, underscoring the growing sophistication of cyber threats.
The campaign, observed between April 14 and 16, 2026, used highly convincing “code of conduct” or compliance-themed emails to trick recipients into interacting with malicious links. These emails were designed to appear as legitimate internal communications, increasing the likelihood of user engagement.
Once users clicked through, attackers redirected them to fake login pages to steal authentication credentials and session tokens. In some cases, this allowed threat actors to bypass even multi-factor authentication protections, making the attack particularly dangerous.
The majority of targets were based in the United States, with industries such as healthcare, financial services, professional services, and technology among the most affected.
What makes this campaign notable is the use of legitimate email services and multi-stage attack techniques, including CAPTCHA pages and polished templates, to evade traditional security filters and appear more credible.
The incident reflects a broader shift in phishing tactics, where attackers are increasingly leveraging advanced techniques and even AI to create more convincing and scalable attacks. As digital ecosystems expand, organizations are being urged to strengthen security awareness and adopt more robust detection mechanisms.
About Microsoft:
Microsoft is a global technology company offering software, cloud, and security solutions, with a strong focus on cybersecurity and enterprise protection.
Source and Credits: Free Press Journal