GCVE-110-CERTFI-2023-0020

Criminals are phishing Microsoft 365 passwords with fake email messages. The usernames and passwords acquired by phishing can be used by the criminals to break into M356 accounts. Dozens of Finnish organisations have reported phishing messages and new data breaches. The phishing campaign spreads between organisations through the contacts of the hacked user accounts.