Analysis of a JavaScript-based Phishing Campaign Targeting Microsoft 365 Credentials
A sophisticated JavaScript-based credential harvesting campaign has been discovered, utilizing fake voicemail notifications to capture Microsoft 365 credentials. The attackers employ HTML smuggling, obfuscation, and encryption techniques to evade detection. The phishing emails contain PDF attachments with QR codes and HTM files with embedded JavaScript. The malicious code uses base64 encoding, CryptoJS for encryption, and dynamic URL generation to redirect victims to a fake Microsoft 365 login page. The campaign involves multiple stages, including CAPTCHA and media player mimicry, to increase legitimacy. This evolving threat poses significant challenges for automated detection and analysis systems.
Pulse ID: 67c76948c1381d8741fff9f8
Pulse Link: https://otx.alienvault.com/pulse/67c76948c1381d8741fff9f8
Pulse Author: AlienVault
Created: 2025-03-04 20:57:44
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
