Enterprises relying on Microsoft 365 and identity services
Incidents Harmed By
Incident 10687 Report
AI-Powered Presentation Tool Gamma Implicated in Multi-Stage Phishing Campaign
2025-04-15
Attackers reportedly exploited Gamma, an AI-powered presentation tool, to create convincing presentation pages that hosted links to a spoofed Microsoft SharePoint login portal. The phishing flow allegedly used compromised email accounts, Cloudflare Turnstile for bot evasion, and adversary-in-the-middle (AiTM) tactics to validate credentials in real time and capture session cookies. The campaign aimed to bypass MFA and compromise accounts.
MoreIncident 17812 Report
ARTEX AI Agents Reportedly Used Stolen Cloud Backup Credentials to Access ConnectWise Customers' Microsoft 365 Environments
2026-10-15
Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.
MoreRelated Entities
Other entities that are related to the same incident. For example, if the developer of an incident is this entity but the deployer is another entity, they are marked as related entities.
Related Entities
Gamma
Incidents Harmed By
- Incident 10687 Reports
AI-Powered Presentation Tool Gamma Implicated in Multi-Stage Phishing Campaign
Incidents involved as Developer
- Incident 10687 Reports
AI-Powered Presentation Tool Gamma Implicated in Multi-Stage Phishing Campaign