Storyline
Microsoft warns of large-scale phishing campaign targeting thousands globally
Microsoft has disclosed a sophisticated phishing campaign that targeted over 35,000 users across more than 13,000 organizations in 26 countries, primarily in the US.
Current brief openSource links open
This current storyline is open here with summary, metadata, source links, continuity context, and full evidence. Paid is for compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
Microsoft has disclosed a sophisticated phishing campaign that targeted over 35,000 users across more than 13,000 organizations in 26 countries, primarily in the US.
Score total
1.97
Momentum 24h
6
Posts
6
Origins
6
Source types
2
Duplicate ratio
0%
Why now
- The campaign was active recently in April 2026, indicating ongoing threat activity.
- New malware abusing Microsoft Phone Link was first observed in January 2026, showing evolving attack techniques.
- Microsoft's public warnings help organizations strengthen defenses against these sophisticated attacks.
Why it matters
- Phishing campaigns targeting large organizations risk widespread credential theft and account compromise.
- Malware exploiting trusted Microsoft services can bypass traditional mobile security controls.
- Understanding attack methods aids SOC teams in detecting and mitigating similar threats.
Continuity snapshot
- Trend status: insufficient_history.
- Continuity stage: broad_confirmed.
- Current status: open.
- 6 current source-linked posts are attached to this storyline.
All evidence
All evidence
The Hacker News - Microsoft details phishing campaign
thehackernews.com · thehackernews.com · 2026-05-05 06:35 UTC
CSO Online - Malware abuses Microsoft Phone Link to siphon SMS OTPs
csoonline.com · csoonline.com · 2026-05-05 11:05 UTC
Microsoft Flags Mass Phishing Campaign Using Fake Compliance Emails
Infosecurity Magazine · infosecurity-magazine.com · 2026-05-05 16:00 UTC
Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations
SecurityWeek · securityweek.com · 2026-05-05 14:45 UTC
Microsoft: Phishing campaign used fake compliance notices to compromise employee accounts
Help Net Security · helpnetsecurity.com · 2026-05-05 11:04 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 5Origin domains: 5Duplicates: -
Showing 5 / 0
Top publishers (this list)
- thehackernews.com (1)
- csoonline.com (1)
- Infosecurity Magazine (1)
- SecurityWeek (1)
- Help Net Security (1)
Top origin domains (this list)
- thehackernews.com (1)
- csoonline.com (1)
- infosecurity-magazine.com (1)
- securityweek.com (1)
- helpnetsecurity.com (1)