Attacker uses an Office 365 site to steal user credentials

by Don Sharpe
Don Sharpe
Don Sharpe
Don has been writing professionally for over 10 years now, but his passion for the written word started back in his elementary school days. His work has been... read more
Affiliate Disclosure
  • Hackers set up an Office 365 login page to steal users' Microsoft credentials. 
  • Remote workers using VPNs to securely connect to company networks were a target for the email phishing attacks.
  • You can always visit our Office 365 hub for relevant tips, guides, and news. 
  • Would you like to optimize your company's virtual private network security? Check out the VPN page for practical recommendations and tools!


VPN targeted for cyber attacks

Email phishing may be one of the oldest tricks up the sleeves of any hacker, but it hasn’t run out of fashion yet. For example, a malicious player recently set up an Office 365 phishing base to fraudulently obtain usercredentials.

Pretty much any platform that requires user authentication to allow access can be a target for phishing.

Also, anyone can be a victim, from SaaS customers to OneDrive users.

Best VPNs we recommend

  1. Private Internet Access - Access content across the globe at the highest speed rate.
  2. NordVPN - Secure multiple devices and enjoy stable connections anywhere.
  3. SurfShark - Price convenient VPN service with all-rounded security features.
  4. CyberGhost - Connect to thousands of servers for persistent seamless browsing.
  5. ExpressVPN - Browse the web from multiple devices with increased security protocols.

Malicious actors created an Office 365 email phishing site

Hackers sent remote workers malicious email links to fraudulently capture their user credentials, according to an Abnormal Security report.

For starters, they took advantage of the fact that many organizations are currently setting up VPNs to secure internet connections for their work-at-home employees.

The target receives an email disguised as official communication from their employer’s IT department in this phishing attempt.

Next, the target clicks the link in the email, which leads to a VPN configuration that the attacker set up. In the end, the employee lands on a login page hosted on the Office 365 platform.

Since the site looks almost 100% the same as the genuine one, the remote worker, sadly, falls for it.

Therefore, the victim supplies their login details oblivious of the fact that they’re not signing into their employer’s official portal.  So, just like that, the bad actor makes away with the target’s Microsoft credentials.

The attack impersonates a notification email from the IT support at the recipients’ company. The sender email address is spoofed to impersonate the domain of the targets’ respective organizations. The link provided in the email allegedly directs to a new VPN configuration for home access. Though the link appears to be related to the target’s company, the hyperlink actually directs to an Office 365 credential phishing website.

Here are tips for optimizing your email security:

  • User discretion: Always check the URL of any web form that requires your user credentials.
  • Email security: Use email scanning anti-malware.
  • Windows updates: Always install Windows security updates.
  • Microsoft’s security tools: This can elevate your threat detection capabilities.

Have you ever been a victim of email phishing? Feel free to share your experience in the comments section below.

Your connection is not secure - websites you visit can find out your details:

  • Your IP
  • Your IP Address:

Companies can sell this information, alongside your location and internet provider name, and profit from it by serving targeted ads or monitoring your data usage.

Use a VPN to protect your privacy and secure your connection.

We recommend Private Internet Access, a VPN with a no-log policy, open source code, ad blocking and much more; now 79% off.

This article covers:Topics: