Microsoft has disclosed a sophisticated phishing campaign that targeted over 35,000 users across more than 13,000 organizations in 26 countries, primarily in the US.

Entities

MicrosoftCisco TalosCloudZ RATPheno pluginAlex KarkinsChetan Raghuprasad

Score total

1.97

Momentum 24h

Posts

Origins

Source types

Duplicate ratio

Why now

The campaign was active recently in April 2026, indicating ongoing threat activity.
New malware abusing Microsoft Phone Link was first observed in January 2026, showing evolving attack techniques.
Microsoft's public warnings help organizations strengthen defenses against these sophisticated attacks.

Why it matters

Phishing campaigns targeting large organizations risk widespread credential theft and account compromise.
Malware exploiting trusted Microsoft services can bypass traditional mobile security controls.
Understanding attack methods aids SOC teams in detecting and mitigating similar threats.

LLM analysis

Topic mix: lowPromo risk: lowSource quality: high

Recurring claims

A large-scale phishing campaign targeted over 35,000 users across 13,000 organizations in 26 countries using fake compliance emails to steal credentials.
Malware abusing Microsoft Phone Link can intercept SMS one-time passwords from enterprise PCs to steal credentials.

How sources frame it

The Hacker News: neutral
CSO Online: neutral

This briefing consolidates recent reports on a major Microsoft-themed phishing campaign and a related malware threat abusing Microsoft Phone Link, emphasizing the scale and sophistication of current credential theft...

All evidence

Microsoft Flags Mass Phishing Campaign Using Fake Compliance Emails

Infosecurity Magazine · infosecurity-magazine.com · 2026-05-05 16:00 UTC

Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations

SecurityWeek · securityweek.com · 2026-05-05 14:45 UTC

New Phishing Campaign Targets US with Credential Theft: What CISOs Need to Know

redteamsec · any.run · 2026-05-05 13:26 UTC

Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs

CSO Online · csoonline.com · 2026-05-05 11:05 UTC

Microsoft: Phishing campaign used fake compliance notices to compromise employee accounts

Help Net Security · helpnetsecurity.com · 2026-05-05 11:04 UTC

Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries