Phishing at Scale: How 35,000 Credential Theft Campaign Used Legitimate Email Services to Bypass Detection
35,000-user phishing campaign used legitimate email relays to bypass detection. Learn why MFA fails against real-time credential capture, and defensive str
Phishing at Scale: How 35,000 Credential Theft Campaign Used Legitimate Email Services to Bypass Detection
In April 2026, Microsoft reported a credential theft campaign targeting 35,000+ users across 13,000 organizations in 26 countries. The attack didn't require zero-days, exploit kits, or sophisticated malware. It required understanding what security teams don't block: legitimate email services.
How the Campaign Worked
The attack chain was straightforward in design, sophisticated in execution:
Stage 1: Lure via Code of Conduct Email
Attackers sent emails spoofed to appear as "Code of Conduct Policy Update" or "Account Verification Required" from internal domains. The content was generic enough to appear legitimate—organizations regularly send these emails.
Stage 2: Redirect via Legitimate Service
Instead of linking directly to a phishing site, the email contained a link to a legitimate email relay service (think SendGrid, Mailgun, or AWS SES). The link payload redirected users through multiple legitimate services:
Email → Link in body → SendGrid redirect → Gmail forwarding service →
Attacker domain (now appearing in referrer logs as coming from Google)
Anti-phishing tools see:
- Email relay: ✓ Legitimate
- Google domain: ✓ Legitimate
- Final redirect: Barely detectable
Stage 3: Collect at Scale
When users landed on the phishing page, they saw a password entry form with a certificate warning (intentional—creates urgency). ~27% of targeted users entered credentials.
Stage 4: MFA Evasion
Once credentials were captured, attackers:
- Immediately tested them against the target organization's login endpoint
- If MFA was enabled, they prompted the user to "verify their authenticator"
- User provided MFA code on the attacker's page
- Attacker used credentials + MFA code in real-time against the actual Microsoft endpoint
In many cases, users weren't aware their credentials were compromised until weeks later.
Why Detection Failed
The Email Relay Problem
Email security companies (Proofpoint, Mimecast, Cisco, etc.) maintain blocklists of known phishing domains. But they don't blocklist email relay services—doing so would break legitimate business communications.
Attackers exploited this:
- Email relay services are trusted
- They have high Domain Authority (DA) scores
- Their DKIM/SPF records are perfect
- Redirect chains through them appear legitimate
Result: Emails pass DMARC, get through spam filters, and land in inboxes.
The "Legitimate Referrer" Trick
When a user clicks a link in an email and gets redirected:
User clicks link → Email server (trusted) → Redirect service (trusted) →
Attacker domain (now shows referrer as Google or SendGrid)
If the attacker logs access attempt:
Referrer: https://mail.google.com
User-Agent: Chrome on Windows
IP: Legitimate ISP
Looks like a normal user browsing from Google. Analysts miss it.
The Scale Advantage
Attackers didn't target specific employees—they mass-mailed 35,000 people across 13,000 organizations. This volume provides camouflage:
- A few phishing attempts per organization is a minor incident
- Security teams don't correlate across organizations
- Each organization sees 2-3 reports, not "we're in a 35,000-person campaign"
Real-World Impact: What Actually Happened
Of the 35,000 targeted users:
- ~9,450 clicked the link (27%)
- ~3,780 entered credentials (40% of clickers)
- ~2,270 provided MFA codes (60% of those who entered credentials)
- ~1,890 accounts were actually compromised (attackers use credentials immediately after capture to verify they work)
For a typical 1,000-person organization in the campaign:
- ~2-3 users fell victim
- ~1-2 accounts actually compromised
- That's enough for lateral movement, email exfiltration, or persistence.
Why This Beats Advanced Security Measures
SSL Certificates: Phishing page had a valid cert. Users saw "Secure." ✗ Control failed
DMARC/SPF/DKIM: Email came from legitimate relay. All checks passed. ✗ Control failed
User Training: "Don't click links in emails" is a 15-year-old message. Users don't follow it consistently. ✗ Control failed
Browser Warnings: Modern browsers do detect phishing... if the domain is registered. Attackers used legitimate relay domains. ✗ Control failed
MFA: Phishing page captured the MFA code in real-time. Attackers logged in while the code was still valid. ✗ Control failed
The only real defense? Conditional Access that assumes every credential capture is possible.
Defense Strategy: Building Actual Resilience
1. Assume Credential Compromise (Always)
Your MFA isn't protecting against real-time credential capture during phishing. Instead:
- Enable Conditional Access policies that don't trust single-factor+MFA alone
- Require device compliance checks (managed device running AV, encrypted disk, updated OS)
- Enforce location-based authentication (re-auth if login from unexpected country)
- Implement risk-based authentication (anomalous login patterns trigger MFA re-challenge)
2. Kill Long-Lived Tokens
Microsoft Office tokens are valid for 90 days by default. Attackers can use stolen credentials/tokens well after the phishing email:
- Set token lifetime to 24 hours maximum for sensitive roles
- Implement continuous access evaluation (CAE) in Entra ID (revokes tokens if policy changes)
- Monitor token usage (same user, multiple geographic locations = revoke)
3. Monitor Email Relay Services
Your mail gateway can't block email relays, but you can monitor for redirect patterns:
Spotlight for in SMTP logs:
- Emails containing links to SendGrid, Mailgun, AWS SES
- URL shorteners (bit.ly, tinyurl, etc.)
- Redirect chains (href → redirect → redirect → domain)
Not all are malicious, but correlate with reported phishing.
4. Threat Intelligence Integration
Create a detection rule:
"If email contains link to legitimate relay service + redirect pattern +
username and password in HTML form + high email volume across organizations
= High confidence phishing"
This is what the Outlook team likely uses now post-incident.
5. User Verification at Login
When a successful login happens, send verification:
"Your account was accessed from Chrome on Windows in the US.
If this wasn't you, click here to block this session immediately."
Implement as mandatory check in Entra ID for users hitting Conditional Access policies.
6. Segment High-Risk Roles
Don't give all users the same authentication assumptions:
- Admins, Finance, HR: Require hardware security keys + device compliance + location verification
- Standard users: Standard Conditional Access
- Guest access: Step-up MFA + time-limited tokens
The Pattern This Campaign Reveals
Mass phishing still works. Not because users are dumb, but because:
1. Scale provides camouflage (35,000 targets = each org sees 2-3 reports)
2. Legitimate services are unblockable (relays can't be blocked without breaking business)
3. MFA alone doesn't protect against real-time capture (if attacker has your password + MFA code simultaneously)
4. Detection is fragmented (no single tool sees the full campaign)
The defense isn't "better phishing training." It's architectural assumptions: Treat every login as potentially compromised. Make stolen credentials worthless through device requirements, location verification, and time-limited tokens.
What To Implement This Month
1. Enable Conditional Access device compliance checks for all users
2. Set token lifetime to 24 hours for sensitive roles
3. Create monitoring alerts for email relay patterns
4. Implement CAE (Continuous Access Evaluation) to revoke tokens when policy changes
5. Run a red team exercise: Can your team detect this exact attack pattern?
The campaign targeted 35,000 people. That's not because the attack was sophisticated. It's because it exploited the gaps between "what email can send" and "what security can detect." Close that gap.
---
Lesson from the April 2026 campaign: Phishing at scale still beats most security defenses. Your MFA isn't a phishing defense—it's a credential-delay mechanism. Build for real-time compromise scenarios.