Explanation
Threat actors are using compromised accounts to collect e-mail credentials. By using compromised accounts, the e-mail seems legitimate at first glance as it seems to originate from a known and trusted source. In reality, however, it is malicious.
The phishing mail leads the user to believe that there is a document to be reviewed. By clicking on the fake link the user is first redirected to a fake OneNote page. Clicking on ‘Appuyez ici pour voir et imprimer le document’ the user is redirected to a phishing form, which asks for e-mail credentials.
Example
