Unauthorized Field Journal
Archive Link Stable
Vol. IV
UTM: 13T 0556842 5193208 | 2026.03.15 — 0450Z
INCOMING
UFJ-0047 — Why Incident Response Fails Before the Incident Starts // 2026.03.10
UFJ-0046 — The Security Stack Is Starting to Look Like a Hoarder House // 2026.03.08
UFJ-0048 — Observed: Credential Phishing Campaign Targeting O365 Admins // 2026.03.06
UFJ-0045 — Testing AI in the Security Workbench Without Becoming an Idiot About It // 2026.03.04
UFJ-0044 — Q1 Threat Landscape: What the Field Is Actually Seeing // 2026.03.01
UFJ-0047 — Why Incident Response Fails Before the Incident Starts // 2026.03.10
UFJ-0046 — The Security Stack Is Starting to Look Like a Hoarder House // 2026.03.08
UFJ-0048 — Observed: Credential Phishing Campaign Targeting O365 Admins // 2026.03.06
UFJ-0045 — Testing AI in the Security Workbench Without Becoming an Idiot About It // 2026.03.04
UFJ-0044 — Q1 Threat Landscape: What the Field Is Actually Seeing // 2026.03.01
UFJ-0048
Anomaly
Source verified

Observed: Credential Phishing Campaign Targeting O365 Admins

Recovered 2026.03.06
1130Z
4 min read
Source: nqztr

Spotted a coordinated credential phishing campaign this week targeting O365 admin accounts. The lure is convincing enough that it caught two people I’d consider experienced. Worth knowing what it looks like.