Microsoft Details Phishing Campaign Targeting 35,000 Users in 26 Countries

Microsoft has revealed details of a substantial credential theft operation, observed between April 14 and 16, 2026. This multi-stage campaign, as reported by The Hacker News, leveraged “code of conduct” themed lures and legitimate email services to trick users. The objective was to direct victims to attacker-controlled domains and subsequently steal authentication tokens.

This sophisticated attack impacted over 35,000 users across more than 13,000 organizations in 26 different countries. The broad scope indicates a well-resourced actor, aiming for maximum reach and credential harvesting. The use of legitimate email services also makes these phishing attempts harder to detect with traditional email security gateways.

Attackers are consistently refining their social engineering tactics. This campaign highlights their shift towards abusing trusted platforms and employing contextually relevant lures to bypass defenses and gain initial access. The focus on authentication tokens, not just passwords, points to a more advanced post-compromise strategy, aiming for persistent access and session hijacking.