Microsoft has disclosed a sophisticated phishing campaign that targeted over 35,000 users across 13,000 organizations in 26 countries, primarily in the US.

Entities

MicrosoftVENOMOUS#HELPERCloudZPheno

Score total

2.08

Momentum 24h

Posts

Origins

Source types

Duplicate ratio

Why now

Campaigns are active and recent, with Microsoft disclosures in early May 2026.
Attackers exploit trusted platforms and compliance themes to increase success rates.
Emerging malware techniques highlight evolving threats to enterprise authentication methods.

Why it matters

Phishing campaigns targeting thousands globally risk widespread credential theft and account compromise.
Use of legitimate RMM tools by attackers complicates detection and remediation efforts.
Malware intercepting SMS OTPs threatens multi-factor authentication security in enterprises.

LLM analysis

Topic mix: lowPromo risk: lowSource quality: medium

Recurring claims

A large-scale phishing campaign targeted over 35,000 users across 13,000 organizations using fake compliance emails and adversary-in-the-middle techniques.
The VENOMOUS#HELPER campaign uses signed Remote Monitoring and Management tools to maintain persistent access in over 80 US organizations.
Malware abusing Microsoft Phone Link intercepts SMS-based one-time passwords from enterprise PCs, threatening multi-factor authentication.

How sources frame it

Microsoft Security Researchers And Independent...: neutral

This briefing consolidates multiple recent Microsoft-related phishing and malware campaigns, highlighting their scale, techniques, and impact on enterprise security.

All evidence

Microsoft Flags Mass Phishing Campaign Using Fake Compliance Emails

Infosecurity Magazine · infosecurity-magazine.com · 2026-05-05 16:00 UTC

Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations

SecurityWeek · securityweek.com · 2026-05-05 14:45 UTC

New Phishing Campaign Targets US with Credential Theft: What CISOs Need to Know

redteamsec · any.run · 2026-05-05 13:26 UTC

Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs

CSO Online · csoonline.com · 2026-05-05 11:05 UTC

Microsoft: Phishing campaign used fake compliance notices to compromise employee accounts

Help Net Security · helpnetsecurity.com · 2026-05-05 11:04 UTC

Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries