{"success":true,"data":{"id":"fake-microsoft-365-office-account-phish","label":"Fake Microsoft 365 / Office 365 / Teams account suspended phishing — impersonates Microsoft security notices claiming account is suspended, password expired, or unusual sign-in detected, driving to a credential-harvest page; Microsoft is the #1 most impersonated brand in business email phishing (APWG 2024); FBI IC3 2023: Microsoft-impersonation BEC caused $2.9B in losses","description":"Phishing emails impersonating Microsoft security notices to claim the victim's Microsoft 365, Office 365, Teams, or Outlook account has been suspended, locked, or has an expired password requiring immediate action — directing to a credential-harvest page styled as Microsoft's sign-in portal. Key facts: (1) APWG 2024 Phishing Activity Trends Report: Microsoft is consistently the #1 most impersonated brand in business email phishing, appearing in more than 20% of all brand-phishing emails; Microsoft 365 credentials are the highest-value target in corporate credential harvesting because they provide access to email, SharePoint, Teams, Azure AD, and all integrated business applications; (2) FBI IC3 2023: business email compromise (BEC) enabled by Microsoft impersonation phishing resulted in $2.9B in reported losses — the largest category of financial cybercrime; the credential-harvest-to-BEC pipeline typically takes 48–72 hours from the initial click to the first fraudulent wire transfer request; (3) Microsoft 365 phishing campaigns frequently use adversary-in-the-middle (AiTM) proxies that capture both credentials and session cookies — bypassing SMS-based MFA and allowing attackers to maintain persistent access even after a password reset; (4) Legitimate Microsoft security notifications arrive from accountprotection.microsoft.com or account.microsoft.com, always include a \"Review recent activity\" link that deep-links to account.microsoft.com (never a third-party domain), and never threaten permanent account deactivation via a standalone link. Warning signs: sender domain not microsoft.com or microsoftonline.com, link to a non-Microsoft domain, threat of permanent deactivation, no reference to the specific device or location of the suspicious sign-in, no MFA challenge.","tier":"danger","category":"phishing","isThin":false}}