A reported campaign used a fake Microsoft 365 sign-in to target users

On October 17, 2026, Escudo Digital reported that a Kaspersky investigation counted more than 390,000 phishing attacks using legitimate cloud infrastructure during the preceding 12 months. The report separately described a campaign targeting Microsoft 365 users. Escudo Digital’s report names Cloudflare Workers, Vercel, Netlify, GitHub Pages and IPFS among services used in broader phishing activity.

How the reported Microsoft 365 campaign worked

The campaign began with an email that appeared to come from someone the recipient knew and urged them to sign in. A fake CAPTCHA—a test often used to distinguish people from automated traffic—asked for a corporate email address. The browser then redirected to a Cloudflare Workers subdomain, followed by another CAPTCHA and a counterfeit Microsoft 365 sign-in.

Escudo Digital described the sign-in as a Browser-in-the-Browser (BiTB) imitation: a fake browser window displayed inside a webpage. The attacker-controlled form was designed to collect usernames, passwords, multi-factor authentication (MFA) codes and session cookies. A generic error page appeared afterward.

Those details describe the reported Microsoft 365 campaign; the broader attack count covers phishing using legitimate cloud infrastructure. The services named in the broader list are not all identified as part of this particular sequence.

If you receive a Microsoft verification code you didn’t request

Microsoft says an unexpected code can mean someone tried to sign in, someone entered your phone number or email address by mistake, or a previously requested code arrived late. Microsoft’s guidance is not to reply to a code you did not request. Review your account’s recent sign-in activity; if it appears someone accessed your account, change your password and follow Microsoft’s unusual sign-in guidance.

Report a suspicious email in Outlook

In Outlook, select the message, open the built-in Report control and choose Report phishing. Microsoft says the reporting route can depend on your organization’s configuration; its Outlook guidance and admin documentation describe the option and submission process.