Phishing scams involving Microsoft have soared in the past three months, according to research from the security firm Check Point. Moving from third place in Q1 2023 to top spot in Q2. The tech giant accounted for 29% of all brand phishing attempts. A phishing scheme, in which cybercriminals directed deceptive messages toward account holders concerning suspicious transactions on their accounts, could offer a partial explanation for this.

Top phishing Q2 2023

1.Microsoft (29%)

2.Google (19.5%)

3.Apple (5.2%)

4.Wells Fargo (4.2%)

5.Amazon (4%)

6.Walmart (3.9%)

7.Roblox (3.8%)

8.LinkedIn (3%)

9.Home Depot (2.5%)

10.Facebook (2.1%)

Microsoft Unusual Activity

A phishing campaign targeted Microsoft account holders by sending fraudulent messages regarding unusual sign-in activity. The campaign involved deceptive emails which were sent allegedly from inside the company withsender names such as “Microsoft on <company domain>”. The subject line of these phishing emails was “RE: Microsoft account unusual sign-in activity” and they claimed to have detected unusual sign-in activity on the recipient’s Microsoft account. The emails provided details of the alleged sign-in,such as the country/region, IP address, date, platform and browser. To address this supposed security concern, the phishing emails urged recipients to review their recent activity by clicking on a provided link which leads to malicious websites unrelated to Microsoft. The URLs used in the campaign, were designed to steal user credentials or personal information, or to download malicious content onto the user’s device.

Where to report

Your workplace’s IT department. If you received a suspected phishing email in your work email inbox, you should contact a supervisor or your company’s IT department. It is very important that you report the situation promptly–cybercriminals might be targeting your company at large so early detection can be critical in stopping this.

Your email provider. Deleting spam, malicious messages or any other suspicious emails keeps you safe, but you canbolster your cybersecurity by reporting any serious cybercrime attempt to your email client. Manyemail services like Gmail and Outlook make this very easy to do. You can also block senders, so you can ensure a bad actor email account never contacts you again, but bear in mind cybercriminals change email addresses and spoof legit ones.

OCD Tech experts can assist you, contact us!