Attacker uses an Office 365 site to steal user credentials

Don Sharpe
by Don Sharpe
Affiliate Disclosure
Share this article:

  • Hackers set up an Office 365 login page to steal users' Microsoft credentials. 
  • Remote workers using VPNs to securely connect to company networks were a target for the email phishing attacks.
  • You can always visit our Office 365 hub for relevant tips, guides, and news. 
  • Would you like to optimize your company's virtual private network security? Check out the VPN page for practical recommendations and tools!


VPN targeted for cyber attacks

Email phishing may be one of the oldest tricks up the sleeves of any hacker, but it hasn’t run out of fashion yet. For example, a malicious player recently set up an Office 365 phishing base to fraudulently obtain usercredentials.

Pretty much any platform that requires user authentication to allow access can be a target for phishing.

testing VPN
How we choose a VPN for you

Our team tests various VPN brands and we recommend them to our users by:

  1. Server park: over 20 000 servers around the world, high speeds and key-locations
  2. Privacy care: a lot of VPNs keep many user logs, so we scan for those that do not
  3. Fair prices: we choose the best affordable offers and always hunt for the best deals.



Disclosure: is reader supported.
Read our affiliate disclosure.

Also, anyone can be a victim, from SaaS customers to OneDrive users.

Malicious actors created an Office 365 email phishing site

5 Best VPNs we recommend

PIA VPN 79% Off
+ 2 free Months
sale-coupon Check offer!
CyberGhost VPN 83% Off (2.25$/Month)
+ 3 free Months
Check offer!
NordVPN 68% Off + 1, 12 or 24 free Months (random prize) Check offer!
SurfShark VPN 83% Off (2.21$/Month)
+ 3 free Months
Check offer!
BullGuard VPN 76% (2.83$)
on 2 Years plan
Check offer!

Hackers sent remote workers malicious email links to fraudulently capture their user credentials, according to an Abnormal Security report.

For starters, they took advantage of the fact that many organizations are currently setting up VPNs to secure internet connections for their work-at-home employees.

The target receives an email disguised as official communication from their employer’s IT department in this phishing attempt.

Next, the target clicks the link in the email, which leads to a VPN configuration that the attacker set up. In the end, the employee lands on a login page hosted on the Office 365 platform.

Since the site looks almost 100% the same as the genuine one, the remote worker, sadly, falls for it.

Therefore, the victim supplies their login details oblivious of the fact that they’re not signing into their employer’s official portal.  So, just like that, the bad actor makes away with the target’s Microsoft credentials.

The attack impersonates a notification email from the IT support at the recipients’ company. The sender email address is spoofed to impersonate the domain of the targets’ respective organizations. The link provided in the email allegedly directs to a new VPN configuration for home access. Though the link appears to be related to the target’s company, the hyperlink actually directs to an Office 365 credential phishing website.

Here are tips for optimizing your email security:

  • User discretion: Always check the URL of any web form that requires your user credentials.
  • Email security: Use email scanning anti-malware.
  • Windows updates: Always install Windows security updates.
  • Microsoft’s security tools: This can elevate your threat detection capabilities.

Have you ever been a victim of email phishing? Feel free to share your experience in the comments section below.