Search results

📱PhishingReviewed

Fake Microsoft Teams booking page used gpimmlgration.com to steal Microsoft 365 accounts

Threat-intelligence service Threadlinqs published on 13 November 2026 an analysis of a Huntress-reported spear-phishing attack in which a fake 'Microsoft Teams Meeting Scheduler' booking page tricked a victim into ent…

• gpimmlgration.com
• Lure via share.google short link; fake 'Microsoft Teams Meeting Scheduler'
• Microsoft 365 device-code phishing kits

Reported Nov 13, 20261 report

📱PhishingReviewed

LevelBlue: 'BlackApex' device-code phishing kits steal Microsoft 365 tokens via fake SharePoint and Zoom lures

LevelBlue SpiderLabs described on 30 October 2026 “BlackApex”-family phishing kits that use fake SharePoint and Zoom pages to get victims to approve a Microsoft device code and give attackers Microsoft 365 tokens. Microsoft and Zoom are not involved.

• miscrosoftonlinesecuredemandocument.com
• Also securemsexcel.online, 1mdrvpdf-rfqonlineinvite.com; kit panels BlackApex, DarkApex, SPY, XXX101
• Microsoft 365 device-code phishing kits

Reported Oct 30, 20261 report

📱PhishingReviewed

SkyW4lker Microsoft 365 device-code phishing kit using csr-rooflng.com and ecmholdlnggroup.com

ANY.RUN reports that SkyW4lker (also called SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users, mainly in the United States. Phishing emails carry a password-protected attachm…

• csr-rooflng.com
• Also: ecmholdlnggroup.com, flow505.mooo.com, bigbrain.chickenkiller.com, off365acess.jumpingcrab.com (per ANY.RUN)
• Microsoft 365 device-code phishing kits

Reported Oct 27, 20261 report

Results reflect reports submitted to Scammers.com. Entries marked “Unverified” have not yet been reviewed. A listing is not a finding that any person or business committed fraud.