A massive phishing campaign has been targeting Office 365 (i.e., Microsoft 365) users in over 10,000 organizations since September 2021 and successfully bypassing multi-factor authentication (MFA) set up to protect the accounts. The attackers use proxy servers and phishing websites to steal users’ password and session cookie.

Read full article on Help Net Security