{"id":6680,"date":"2025-09-05T10:04:08","date_gmt":"2025-09-05T10:04:08","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/05\/hackers-use-ai-platforms-to-steal-microsoft-365-credentials-in-phishing-campaign\/"},"modified":"2025-09-05T10:04:08","modified_gmt":"2025-09-05T10:04:08","slug":"hackers-use-ai-platforms-to-steal-microsoft-365-credentials-in-phishing-campaign","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/05\/hackers-use-ai-platforms-to-steal-microsoft-365-credentials-in-phishing-campaign\/","title":{"rendered":"Hackers Use AI Platforms to Steal Microsoft 365 Credentials in Phishing Campaign"},"content":{"rendered":"

Hackers Use AI Platforms to Steal Microsoft 365 Credentials in Phishing Campaign
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cybercriminals are increasingly exploiting the trust organizations place in artificial intelligence platforms to conduct sophisticated phishing attacks, according to a new report from cybersecurity firm Cato Networks. <\/p>\n

The company\u2019s Managed Detection and Response (MDR)<\/a> service recently uncovered a campaign where threat actors leveraged Simplified AI, a popular marketing platform, to steal Microsoft 365 credentials from US-based organizations.<\/p>\n

The attack, discovered in July 2025, successfully compromised at least one US investment firm before being detected and contained. <\/p>\n

While the campaign is no longer active, security experts warn it represents a dangerous evolution in cybercrime<\/a> tactics that could affect organizations across all industries.<\/p>\n

Weaponizing Trusted AI Platforms<\/strong><\/h2>\n

\u201cThreat actors are no longer relying on suspicious servers or cheap lookalike domains,\u201d the Cato Networks report states. <\/p>\n

\u201cInstead, they abuse the reputation and infrastructure of trusted AI platforms that employees already rely on, allowing them to bypass defenses and slip into organizations under the cover of legitimacy.\u201d<\/p>\n

\n
\"Hackers
Weaponizing Trusted AI Platforms<\/figcaption><\/figure>\n<\/div>\n

The sophisticated attack began with emails impersonating executives from a global pharmaceutical distributor, complete with authentic company logos and executive names verified through LinkedIn. <\/p>\n

The emails contained password-protected PDF attachments designed to evade automated security scanners that cannot inspect encrypted files.<\/p>\n

The phishing campaign employed a multi-layered approach that exploited both social engineering<\/a> and technical evasion tactics:<\/p>\n

    \n
  1. \nInitial Contact<\/strong>: Victims received emails appearing to be from pharmaceutical company executives, with passwords for attached PDFs conveniently included in the message body.<\/li>\n
  2. \nPDF Lure<\/strong>: The documents displayed legitimate company branding and contained links directing users to Simplified AI\u2019s platform at app.simplified.com.<\/li>\n
  3. \nTrusted Redirect<\/strong>: Users were taken to what appeared to be a legitimate Simplified AI page, displaying the impersonated company\u2019s name alongside Microsoft 365 imagery.<\/li>\n
  4. \nCredential Harvest<\/strong>: The final step redirected victims to a convincing fake Microsoft 365 login<\/a> portal designed to steal enterprise credentials.<\/li>\n<\/ol>\n

    The attack highlights how cybercriminals are adapting to the rapid adoption of AI tools in corporate environments. <\/p>\n

    AI marketing platforms<\/a> like Simplified AI have become commonplace in enterprises, with IT departments routinely whitelisting their domains and allowing employee access.<\/p>\n

    \n
    \"Hackers
    sample malware document<\/figcaption><\/figure>\n<\/div>\n

    \u201cFor CISOs and IT leaders, approving such services often seems straightforward: allow access, whitelist the domain, and enable the marketing team to innovate,\u201d the report notes<\/a>.<\/p>\n

    \u201cBut what if the very same platform is leveraged by threat actors to steal from you?\u201d<\/p>\n

    This incident reflects broader concerns about \u201cshadow AI\u201d usage in enterprises, where employees increasingly rely on AI tools without proper security oversight. <\/p>\n

    The attackers\u2019 use of established platforms makes detection significantly more challenging for traditional security measures.<\/p>\n

    Mitigations<\/strong><\/h2>\n

    Security experts recommend several protective measures:<\/p>\n