Attackers are actively impersonating Microsoft services to target customers with Microsoft, Office 365, Outlook, and OneDrive accounts.
The campaign was discovered by a security researcher, MalwareHunterTeam. According to the researcher, attackers could fake the custom branding and web hosting features to host static landing phishing sites.
Misused platforms include Microsoft Azure’s Static Web Apps which is used to steal Microsoft, Office 365, Outlook and OneDrive credentials.
While the fake landing pages can be used to scam Microsoft customers, they could also be used to target users of other platforms such as Rackspace, AOL, Yahoo and other email providers.
Users are often advised to check URLs when prompted to fill in their account details in a login form.
However, this advice is almost pointless in this scenario, as users are deceived by the azurestaticapps.net subdomain and the valid TLS certificate.