Today a number of phishing emails got through our M365 Exchange/Defender filters. I analyzed the phishing links through a sandbox and observed that the phishing pages had the exact same custom branding elements—colors, company logo, and specific language—that were designed for our legitimate M365 login portal. The branding was intended to help our users distinguish authentic pages from malicious ones.

The phishing URLs are easy to spot that its malicious. However, I’m concerned our users will overlook the URL check when they are presented with familiar custom branding on the main page.

Reaching out to understand whether these threat actors are engaging in manual customization for targeted phishing campaigns, or if they have the capability to automate the replication of our branding. Yesterday I learned about phishing frameworks like EvilGinX2 which can bypass MFA by funneling victims through a proxy—leading them from a deceptive phishing page to a genuine M365 authentication session. I was wondering if this was the situation being used against us. Thank you in advance!