Watch Out — Microsoft Login Pages Are Being Abused as Hackers Try and Lure in Unlucky Victims, Here's What to Look Out For

Microsoft Login Pages Become Hackers’ Favorite Weapon in Sophisticated Consent Attacks

Attackers no longer bother crafting convincing copies of Microsoft login screens. They send victims straight to the real thing. A recent campaign uncovered by Check Point Research shows how this shift turns everyday authentication flows into gateways for full account takeover. The technique, often called consent phishing, sidesteps traditional defenses. It exploits trust in legitimate Microsoft domains and leaves users with few visual clues to s…

SCIENCE & TECH: Watch out — Microsoft login pages are being abused as hackers try and lure in unlucky victims, here’s what to look out for

Phishing campaign used fake Teams notifications to route victims to a genuine Microsoft sign-in page Rather than stealing passwords, attackers asked victims to approve permissions for an attacker-controlled app, gaining access to mail, files, Teams, SharePoint, OneDrive and calendars without defeating MFA Check Point says the technique has been commoditized in 2026 into a rentable service; the practical defense is restricting app consent rather …

Watch out — Microsoft login pages are being abused as hackers try and lure in unlucky victims, here's what to look out for

Phishing campaign used fake Teams notifications to route victims to a genuine Microsoft sign-in pageRather than stealing passwords, attackers asked victims to approve permissions for an attacker-controlled app, gaining access to mail, files, Teams, SharePoint, OneDrive and calendars without defeating MFACheck Point says the technique has been commoditized in 2026 into a rentable service; the practical defense is restricting app consent rather th…

Hackers Turned Microsoft Logins, Zoom Events, and Government Websites Into Attack Tools

Cybercriminals spent July 2026 proving that trusted business utilities including Microsoft authentication pages, Zoom event invitations, and official government portals can be weaponized against enterprise targets. Threat intelligence research from ANY.RUN reveals that attackers across the United States, Europe, and Brazil systematically exploited routine corporate workflows to bypass perimeter security controls, harvest credentials, and maintai…