A new phishing attack is using fake non-delivery notifications in an attempt to steal users’ Microsoft Office 365 credentials.
SANS ISC Handler Xavier Mertens discovered the attack while reviewing data captured by his honeypots.
The attack begins when a user receives a fake non-delivery notification from Microsoft such as the one shown below: