Darktrace Details Vendor-Compromise Phishing Campaigns Using Trusted Email Relationships

Sep 30, 2025 · Original article ↗

Summary

Darktrace describes four vendor-compromise campaigns targeting one customer in two weeks, using trusted senders, hijacked email threads, and legitimate file-sharing services to deliver fake Microsoft login pages and steal credentials.

Key points

The campaigns used compromised vendor or other organizational accounts to send convincing messages, sometimes inserted into existing email threads.
Messages linked to legitimate file-sharing services, which redirected recipients to fake Microsoft login pages designed to steal credentials.
Emails passed authentication checks and had a Microsoft Spam Confidence Level of 1, despite containing malicious links.
Reported anomalies included unfamiliar senders, unusual BCC use, first-time sharing of file-sharing links, and links that were unusually prominent or concealed.
Darktrace says it identified suspicious messages through behavioral and contextual signals without visiting the linked destinations.
In one customer environment with Autonomous Response enabled, Darktrace held detected emails before they reached recipients; in another, response was not enabled.
The article lists two phishing-page indicators of compromise and maps the activity to phishing under MITRE ATT&CK.

Article Details

Attack Vectors: Compromise of vendor or other trusted-relationship email accounts to send phishing messages from trusted correspondents.
Insertion of malicious messages into existing email threads to blend in and evade detection.
Phishing links hosted on legitimate file-sharing services, sometimes leading through a CAPTCHA to fake Microsoft login pages designed to harvest credentials.
Use of homoglyphs in a phishing URL to make it resemble a legitimate service.
Defensive Notes: Monitor for out-of-character email behavior, including first-time sharing of file-sharing links, unusual link placement or concealment, and new senders using BCC to reach multiple recipients.
Use email detection that evaluates behavioral and contextual anomalies and can identify malicious links without visiting their destinations.
Enable response actions that hold suspicious emails before they reach recipients’ inboxes.
Remain alert to unexpected email activity even when messages come from trusted senders or pass email authentication checks.

Indicators of compromise

Type	Indicator	Context
URL	`hxxp[:]//pub-ac94c05b39aa4f75ad1df88d384932b8[.]r2[.]dev/offline[.]html`	URL identified as a fake Microsoft login page used to capture credentials.
URL	`hxxp[:]//pub-ac94c05b39aa4f75ad1df88d384932b8[.]r2[.]dev/offline[.]html#p`	URL listed as a fake Microsoft login page.
URL	`hxxps[:]//s3[.]us-east-1[.]amazonaws[.]com/s3cure0line-0365cql0[.]19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0[.]19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html#`	Specific cloud-hosted phishing URL identified as a fake login page; its homoglyph spelling was used to deceive users.