Microsoft Discloses Phishing Campaign Targeting 35,000 Users

Microsoft has disclosed a sophisticated phishing campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries between April 14 and 16, 2026, with the vast majority of attempts directed at recipients in the United States.

According to Microsoft's advisory, 92 percent of the emails reached U.S.-based organizations, with healthcare and life sciences firms accounting for 19 percent of targets, followed by financial services at 18 percent, professional services at 11 percent, and technology and software companies at 11 percent. The campaign employed polished, enterprise-style HTML email templates featuring structured layouts, preemptive authenticity statements, and urgent prompts about internal compliance issues, such as code-of-conduct reviews and noncompliance case logs.

The emails impersonated internal departments using display names like "Internal Regulatory COC," "Workforce Communications," and "Team Conduct Report." Subject lines included phrases such as "Internal case log issued under conduct policy" and "Reminder employer opened a noncompliance case log." A notice at the top of each message claimed it had been issued through an authorized internal...