<p>Microsoft has just tweeted a warning for its Office 365 users about an ongoing phishing campaign.</p>
<p><img class="alignnone size-full wp-image-2783" src="https://www.wincert.net/wp-content/uploads/2018/10/hacker_code.jpg" alt="zero-day" width="640" height="373" /></p>
<p>This campaign is using a combination of commonly used spoofing tricks including legitimate-looking original senders&#8217; email addresses, spoofed display sender addresses containing target domains and usernames.</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">The original sender addresses contain variations of the word ";referral"; and use various top-level domains, including the domain com[.]com, popularly used by phishing campaigns for spoofing and typo-squatting.</p>
<p>&mdash; Microsoft Threat Intelligence (@MsftSecIntel) <a href="https://twitter.com/MsftSecIntel/status/1421232635502682118?ref_src=twsrc%5Etfw">July 30, 2021</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>It&#8217;s important to know that the original sender addresses contain <strong>several variations of the word &#8220;referral&#8221;</strong> and some <strong>various top-level domains including the domain com [.]com</strong> which is commonly used in phishing domains.</p>
<p>The company advises its users to be extra cautious when opening e-mails with file share requests for bonuses, staff reports, or similar items. Fake URLs that are being used in these emails can lead users to Office 365 phishing page asking for user credentials.</p>
<p>According to Microsoft, this specific phishing campaign is also using some additional fraud techniques that can be hard to handle.</p>
<p>Microsoft is offering assistance in taking down these phishing sites and for that purpose has posted its advanced hunting query on the <a href="https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Email%20Queries/referral-phish-emails.md" target="_blank" rel="noopener">Github web page</a>.</p>