The Sign-In Page Was Real. That’s Why It Worked.
Most phishing training boils down to one instinct: look at the address bar. Weird domain, misspelled company name, a link that doesn’t match the sender, those are the tells we teach people to catch.
A phishing campaign making the rounds right now doesn’t have any of those tells, because it doesn’t use a fake login page at all. It uses Microsoft’s real one.
Here’s the flow, as reported by security researchers who tracked the campaign through mid-July: an employee gets an email dressed up as a Teams or Planner notification, something like “new task from HR” or a payroll update with a deadline attached. The sender name and the links look like they belong to the employee’s own company. Click through, and you land on the actual login.microsoftonline.com page. Not a lookalike. The real one, with the real Microsoft padlock and the real URL.
The user signs in like normal. Then they see a permissions screen: an app is asking to read their email, access files, or see their Teams and calendar. If they approve it (and most people approve prompts they don’t fully read, especially mid-task), Microsoft’s own system redirects to an endpoint the attacker controls, handing over an access token. No password was stolen. No fake page was cloned. The attacker just asked politely, through a process Microsoft itself runs, and got a “yes.”
This isn’t some rare proof-of-concept. Researchers identified more than 200 of these emails hitting roughly 120 organizations between late June and mid-July 2026, concentrated in manufacturing and professional services firms, mostly in North America. And it’s not a one-off either. It’s becoming a rentable technique, which means it’ll keep showing up in more inboxes, not fewer.
What this means for a small business, plainly: the “check the URL” training most companies run isn’t wrong, it’s just incomplete. This attack lives one step past the login screen, in a part of the process almost nobody has been trained to scrutinize.
What actually helps
1. Train people to read the permission screen, not just the login screen. When an app asks “this application would like to read your mail, access your files, sign in as you,” that’s the moment to pause, not the login form before it. If the request feels out of place for what you just clicked, don’t approve it.
2. Turn off free-for-all user consent if you’re on Microsoft 365. Admins can require that new third-party app requests get approved centrally instead of letting any employee grant access on the spot. That single setting closes most of this attack path by itself.
3. Watch for repeated, identical links inside one email. A legitimate task notification doesn’t usually route every single link, subject line, and button to the same destination. Multiple different-looking links that all land in the same place is a pattern worth flagging.
4. Treat “urgent HR/payroll” framing as a trigger to slow down, not speed up. Attackers use urgency because it works. A task that’s “already overdue” the moment you first hear about it is a manufactured deadline, not a real one.
5. If someone does click through and approve something, don’t stop at a password reset. Revoking the session and changing the password doesn’t undo a consent grant. Somebody needs to check what apps and permissions are currently authorized on that account and pull the ones that shouldn’t be there.
We’ve walked a Central Texas client through almost exactly this: an employee clicked a phishing email that captured Microsoft 365 access, we got the call within 90 minutes, and part of the cleanup was going through their recent OAuth app grants line by line, not just rotating the password. That step is easy to skip if you don’t know to look for it, and it’s the step that actually closes the door.
Cybersecurity for a small business doesn’t need to be complicated. It’s mostly MFA on everything, modern email filtering, quarterly training that keeps up with how attacks actually change, and tested backups. We run all four of those for around 40 customers in and around Waco, and the training piece is the one that has to evolve fastest, because attackers are actively looking for the exact gap this campaign exploits.
If you want a second set of eyes on whether your Microsoft 365 tenant allows open user consent, or you just want someone to walk your team through what a permissions screen like this actually looks like, that’s a quick, no-pressure conversation. We’re easy to reach, and if something like this has already happened in your office, here’s what to do next.