Abnormal Security researchers identified this campaign as part of a growing trend of “living-off-trusted-sites” (LOTS) attacks, where threat actors exploit legitimate services to host malicious content. This campaign highlights the growing sophistication of phishing attacks and emphasizes the need for organizations to implement advanced security solutions that can detect context-based threats rather than relying solely on traditional indicators of compromise. “What makes this campaign particularly dangerous is its use of Gamma, a relatively new platform that employees may not recognize as a potential vector for phishing attacks,” noted the security team. This newly identified attack chain demonstrates how threat actors are increasingly leveraging legitimate platforms to bypass security controls and deceive unsuspecting victims. Cybersecurity experts have uncovered a sophisticated multi-stage phishing campaign that exploits Gamma, an AI-powered presentation tool, to deliver credential-harvesting attacks targeting Microsoft account users. This sophisticated approach demonstrates how modern phishing campaigns have evolved beyond simple credential harvesting to implement complex technical mechanisms that can circumvent even robust security measures. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This addition serves a dual purpose: preventing automated security tools from analyzing the malicious content while simultaneously increasing the perceived legitimacy of the page. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The infection chain concludes at a convincing replica of a Microsoft SharePoint login portal, where the page design mimics Microsoft’s UI patterns with a modal-style login window overlaid on a blurred background. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 17:00:11 +0000