Explanation
Threat actors are using compromised accounts to collect Microsoft 365 credentials.
By using compromised accounts, the e-mail seems legitimate at first glance as it seems to originate from a known and trusted source.
In reality, however, it is malicious.
The phishing mail leads the user to believe that there is a document to review and sign.
By clicking on the link “ÜBERPRÜFUNGS DOKUMENT” the user is presented a fake Microsoft OneNote page,
showing a link to a fake invoice (REVIEW DOCUMENT).
After clicking on the fake link, they are redirected to a fake Microsoft login form.
The owner of the compromised account has been notified.
Example
