The short answer: in 2021 Microsoft's own security researchers published details of two phishing campaigns aimed at Microsoft users. One stole Microsoft 365 passwords with fake invoice attachments for about a year. The other, run by the group Microsoft calls NOBELIUM, used look-alike emails to deliver malware to staff at government agencies, think tanks and nonprofits. Both depended on people opening an attachment or a link, and both are blunted by the same controls: multi-factor authentication, attachment filtering and trained users.

This post summarizes what Microsoft reported and what a business should take from it. The facts below come from Microsoft's published research, linked in each section.

What was the XLS.HTML invoice campaign?

In August 2021, Microsoft described a credential-phishing campaign it had tracked for a year, with ten versions observed between July 2020 and July 2021. The emails used invoice and payment themes. The attachment looked like an Excel file but was actually an HTML file with a name ending in "xls.HTML" or similar. Opening it showed a fake Microsoft 365 sign-in box, often with the target's email address and company logo already filled in.

According to Microsoft, the attackers changed how they hid the malicious code about every 37 days on average, including encoding parts of it in Morse code, so that email filters would keep missing it. Later versions also collected the victim's IP address and location along with the username and password.

Source: Microsoft Security Blog, "Attackers use Morse code, other encryption methods in evasive phishing campaign", August 12, 2021.

What did Microsoft report about NOBELIUM?

In May 2021, the Microsoft Threat Intelligence Center (MSTIC) reported a wave of emails from NOBELIUM, the group behind the SolarWinds compromise. The attackers gained access to a USAID account on the Constant Contact mass-mailing service and sent messages that appeared to come from USAID to about 3,000 accounts at more than 150 organizations.

Microsoft traced earlier waves back to January 2021. Some of those used Google's Firebase platform to host a disk image (ISO) file. When opened, the file ran a hidden program that gave the attackers remote access. Later waves hid the ISO file inside an HTML attachment.

Source: Microsoft Security Blog, "New sophisticated email-based attack from NOBELIUM", May 27, 2021.

Why do these campaigns still matter?

The specific emails are old. The methods are not. Fake invoices, attachments that are really web pages, sign-in pages pre-filled with your company logo and trusted mailing services used to send malicious mail all remain common. A filter that blocked last month's version may not block this month's, which is why the controls below matter more than any single detection rule.

How can a business protect Microsoft 365 accounts from phishing?

The controls below blunt both campaigns. Microsoft's research points to multi-factor authentication, attachment filtering, and Safe Links and Safe Attachments. The rest is standard practice.

  • Require multi-factor authentication for every account, starting with administrators and anyone who can approve payments. A stolen password alone should not be enough to sign in.
  • Block or strip HTML attachments where the business does not need them. Few legitimate senders email invoices as HTML files.
  • Turn on Safe Attachments and Safe Links in Microsoft Defender so files and links are checked when they are opened, not only when the email arrives.
  • Stop password reuse. A password manager and a clear policy make this realistic for staff.
  • Train people to check the address bar before typing a Microsoft password, and give them one simple way to report a suspicious email.
  • Watch sign-in activity for logins from unexpected countries or new devices, and act on the alerts.

Velocity can set up and maintain these controls as part of Microsoft 365 management for Phoenix and East Valley businesses. If you are not sure whether MFA covers every account in your tenant, a free network assessment will tell you, along with how your email filtering and backups are configured. For broader protection, see cybersecurity services.