A sophisticated phishing campaign has exploited Microsoft Teams’ collaboration features to deceive users into revealing sensitive credentials, affecting over 6,000 organizations worldwide through fraudulent billing notifications.
Large-Scale Credential Theft Operation
Security researchers have identified a widespread phishing campaign that delivered 12,866 malicious messages over 13 days, averaging 990 daily phishing attempts.
The campaign compromised 6,135 customers by weaponizing Microsoft Teams’ legitimate guest invitation system to distribute convincing fake billing alerts.
Threat actors initiated the attack by creating Teams workspaces with deceptive names mimicking urgent subscription notifications.
These malicious team names contained fabricated invoice identifiers, dollar amounts, and fraudulent support contact numbers designed to trigger immediate user action.
To circumvent automated security filters, attackers employed character substitution techniques, replacing standard letters with visually similar Unicode characters while maintaining readability for human targets.
According to Checkpoint, the attackers leveraged the “Invite a Guest” functionality within Microsoft Teams to send invitation emails from authentic Microsoft addresses.
Recipients received notifications displaying the malicious team name in prominent typography, creating the illusion of legitimate Microsoft-generated correspondence.
This exploitation of trusted platform infrastructure significantly increased victim susceptibility.
Rather than deploying traditional phishing links or malware attachments, the campaign utilized voice-based social engineering tactics.
Victims were instructed to contact fraudulent support phone numbers to resolve fabricated billing disputes, enabling attackers to extract credentials through direct phone interactions.
The manufacturing, engineering, and construction sector bore the heaviest impact, with 27.4% of affected organisations, followed by technology and SaaS companies at 18.6% and educational institutions at 14.9%.
Professional services, government agencies, and financial organizations accounted for 11.2%, 8.1%, and 7.3%, respectively.
Geographic analysis revealed concentrated activity in the United States, accounting for 67.9% of compromised entities, with Europe accounting for 15.8% and Asia for 6.4%.
In Latin America, Brazil and Mexico accounted for 44% and 31% of incidents, respectively.
This campaign demonstrates evolving attacker methodologies that exploit trusted collaboration platforms through legitimate system features rather than technical vulnerabilities.
Organizations should implement enhanced verification protocols for unexpected Teams invitations, particularly those that use urgent financial language, contain embedded contact numbers, or exhibit irregular character formatting.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
