New Phishing-as-a-Service Threat Targets Microsoft 365 Users

Cybercriminals never stop evolving — and neither should your defenses. The latest example of this evolution is a new “Phishing-as-a-Service” (Ph-a-a-S) platform making the rounds, specifically targeting Microsoft 365 (M365) users worldwide.

According to KnowBe4 Threat Labs, this service, known as Quantum Route Redirect, uses advanced techniques to slip past traditional security tools and trick users into handing over their login credentials. 

It’s a reminder that even well-trained employees can fall for phishing scams that look legitimate at first glance.

How the Attack Works

Like many phishing kits, Quantum Route Redirect’s main goal is to steal M365 usernames and passwords by leading unsuspecting users to fake login pages that look authentic.

These attacks often start with familiar-looking emails — think DocuSign document requests, payroll updates, payment notifications or even missed voicemail alerts. Some campaigns are beginning to use QR codes as lures as well, though that capability is still developing.

When a user clicks a malicious link in one of these messages, they’re sent to a credential-harvesting site hosted on compromised or inactive domains. KnowBe4 Researchers found roughly 1,000 of these domains in use.

What makes this particular kit stand out is its ability to identify and block security bots. Before serving up a phishing page, it analyzes the visitor’s behavior to determine if they’re a real person or an automated scanner. If it detects a bot, it sends it to a harmless page. But if it detects a human, the user is redirected to the fake M365 login page designed to steal credentials.

What's at Stake

While it’s unclear whether this tool can capture multi-factor authentication (MFA) session tokens, the potential risk is real. The majority of affected users so far — about 76% — are based in the U.S., but the attack has already reached more than 90 countries.

This latest wave of phishing activity highlights why security isn’t a one-and-done effort. Even organizations with strong security programs can be vulnerable if they’re running outdated systems or have unmonitored accounts lingering in the background.

How to Protect Your Organization

To strengthen your defenses and reduce your risk exposure, take time to verify that your systems and processes are up to date. Start with these essentials:

• Remove outdated systems. Make sure you’re not running unsupported operating systems like Windows 10 unless you’ve purchased Extended Security Updates (ESU).
• Keep everything patched. Confirm that all machines and supporting hardware (e.g., switches, firewalls and routers) are current and regularly updated.
• Audit your accounts. Eliminate unused, misconfigured or terminated user accounts that could become an easy target.
• Require modern MFA. Implement and enforce MFA across all user accounts, especially administrative ones.

Need Help?

Cyber threats aren’t slowing down, and neither should your awareness. If you’re unsure how to evaluate your current security posture — or want guidance on protecting your M365 environment — our technology consultants can help you assess vulnerabilities, close security gaps and strengthen your overall defenses.

Contact us here or call 410.685.5512 with any questions.