CSuite Phishing Hits US Firms, Steals M365 Sessions

ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions from the United States. Lures mimicking Adobe, DocuSign and Microsoft 365 deliver either credential-harvesting flows that capture Microsoft 365 sessions or BAT/VBS droppers that install legitimate remote-management tools like ScreenConnect and Action1, giving attackers both account and endpoint access.