What Happened to Microsoft 365 Link-Based Hacking Incidents and Phishing Campaigns?

The landscape of 'link hacking' targeting Microsoft 365, which includes Windows 365, has evolved significantly, moving beyond simple malicious links to highly sophisticated, multi-stage attacks. These incidents are not confined to a single breach but represent a continuous cat-and-mouse game between attackers and Microsoft's security measures.

Initially, many link-based attacks focused on traditional phishing, where users were lured by malicious emails to fake login pages designed to steal credentials. However, as security measures like multi-factor authentication (MFA) became more widespread, attackers adapted. A significant turning point has been the rise of 'device code phishing' and OAuth token theft. This technique, which became increasingly prevalent in 2026, involves attackers initiating a legitimate Microsoft device code authorization flow and then tricking users into entering the generated code on a genuine Microsoft verification page. Unbeknownst to the user, this action grants the attacker's device access to their Microsoft 365 account, often bypassing MFA entirely. Phishing-as-a-Service (PhaaS) platforms, such as Kali365, which emerged in April 2026, have democratized these advanced techniques, making them accessible to less-skilled attackers through AI-generated lures and automated campaign tools.

Beyond phishing, vulnerabilities within Microsoft Office and 365 applications themselves have also been exploited through malicious links or documents. For instance, in January 2026, Microsoft disclosed CVE-2026-21509, a flaw affecting Microsoft 365 Apps for Enterprise and various Office versions, which allowed attackers to bypass Object Linking and Embedding (OLE) mitigations. This vulnerability could be exploited by tricking users into opening malicious documents, leading to local security feature bypasses. In August 2025, Microsoft also addressed critical Remote Code Execution (RCE) vulnerabilities (CVE-2025-53731, CVE-2025-53740) in its Office suite that could be triggered merely by previewing a malicious document.

The most recent and notable development, as of July-August 2026, is the 'CaptiveCrunch' campaign, attributed to the Russian state-sponsored threat actor Midnight Blizzard (also known as APT29). This sophisticated operation targets hospitality Wi-Fi networks, manipulating DNS settings on captive portal equipment to redirect users to phishing pages impersonating Microsoft 365 login portals. The campaign, which has been active since at least early May 2026 and has shown signs of AI-augmented operations since February 2026, aims to steal Microsoft 365 credentials and authentication tokens. Microsoft has identified new malware families, CornFlake and ChocoShell, associated with this campaign, capable of persistent access and data exfiltration.

The consequences of these link-based attacks are severe, ranging from credential theft and unauthorized access to email, files, and Teams chats, to broader data exfiltration and business email compromise. Microsoft has responded by issuing emergency patches, tightening security defaults (e.g., for Windows 365 Cloud PCs in late 2025), and providing extensive guidance on preventing phishing and securing accounts. However, the sheer volume of vulnerabilities (over 1,200 reported in 2024, with 157 critical ones in 2025) and the continuous innovation by threat actors mean that securing Microsoft 365 environments remains an ongoing challenge, requiring vigilance and robust security practices from users and organizations alike.