Fighting Back Against Large-Scale Phishing Campaigns Targeting Swedish Municipalities, Regions ...
summary
Between June 2024 and May 2025 attackers compromise Microsoft 365 accounts across Swedish municipalities and regions, abuse SharePoint/OneNote to host a OneNote-hosted phishing portal, and send as many as 7,000 mails per campaign; one successful invoice hijack steals 145,000 SEK. Analysis finds mail rules, added mailbox‑backup apps for exfiltration, and use of EvilProxy/Evil Jinx/Tycoon for MFA bypass. CERT‑SE and SKR publish a nine‑step M365 remediation guide and coordinated distribution corresponds with a measurable drop in incidents by early 2026.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:04Sesi in Swedish cyber security
- 3:30Large-scale phishing campaigns
- 7:26Phishing attack chain
- 8:29Compromised accounts signs
- 9:12Data exfiltration by threat actors
- 9:54Mail rules to hide phishing
- 10:16SharePoint and OneNote in phishing
- 11:41Credential harvesting portal
- 13:10Financial fraud and AiTM attacks
- 13:52Remediation guidance for accounts
- 14:56Collaboration with SKR
- 16:42Nine-step Microsoft 365 remediation
- 19:50Taking down malicious SharePoint
- 20:35Lessons learned and responsibility
- 21:40Building resilience through collaboration
- 22:41Q&A
related talks
45mM365 Adversary ROI: Microsoft Cloud Attack Insights
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
01h 00mDefending Against New Phishing Attacks that Abuse OAuth Authorization Flows
30mGetting Engagement in the Midst of Chaos
45mThe Cyberattack on Visma in 2018, experience sharing and views from the blue team
30mPhishing for Tenants: All I Wanted was for Microsoft to Deliver my Phishing ...
42mIt’s Getting Real & Hitting the Fan 2023 Edition (Real World SaaS Attacks)
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures