Cyberattack Targets 26 Countries in Sophisticated Microsoft Phishing Scheme
Microsoft has disclosed a large-scale phishing campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries between April 14–16, 2026. Around 92% of the victims were based in the U.S., with healthcare, finance, professional services, and technology sectors heavily affected.
The attackers used convincing “code of conduct” themed phishing emails sent through legitimate email delivery services. The messages included PDF attachments and urgent subject lines designed to pressure recipients into clicking malicious links.
Victims were redirected through multiple CAPTCHA checks and fake verification pages before landing on adversary-in-the-middle (AiTM) phishing sites that stole Microsoft credentials and authentication tokens in real time, allowing attackers to bypass multi-factor authentication (MFA).
Microsoft also reported a sharp rise in QR code phishing during Q1 2026, with attacks increasing 146% from January to March. The company detected around 8.3 billion phishing threats during the quarter, with credential theft remaining the primary objective of most campaigns.
Researchers further warned about the growing abuse of trusted platforms such as Amazon Simple Email Service (SES), which attackers use to send phishing emails that can bypass standard email security checks.
Mitigation Recommendations
- Be cautious with unexpected emails, especially those urging urgent action
- Avoid opening unknown PDF attachments or clicking suspicious links
- Avoid scan QR codes from emails you weren’t expecting or don’t trust
- Double-check sender details, even if the message looks official
- Report suspicious emails to your IT or security team immediately
- Use strong, unique passwords for different accounts
- Enable multi-factor authentication whenever possible
- Stay alert for messages asking you to log in or verify account details unexpectedly
- Attend basic cybersecurity or phishing awareness training if available
Source: https://thehackernews.com/2026/05/microsoft-details-phishing-campaign.html