Check Point exposes phishing attack targeting Microsoft CRM users

Cybercriminals are using compromised business accounts to send deceptive emails with fake links that mimic Dynamics 365 Customer Voice communications, including voicemails and PDFs, with over 3,370 phishing emails sent in this ongoing campaign, says Check Point

A newly discovered phishing campaign is exploiting Microsoft’s Dynamics 365 Customer Voice platform to trick employees into revealing sensitive credentials, cybersecurity firm Check Point has revealed. The campaign has already targeted more than 350 organizations and over a million email accounts, with most victims based in the United States.

Dynamics 365 Customer Voice is a widely used customer relationship management (CRM) tool, adopted by nearly half a million businesses globally, including a majority of Fortune 500 companies. It facilitates customer feedback collection, call recording, and survey distribution, making it a credible vector for abuse.

In this attack, cybercriminals use compromised business accounts to send seemingly authentic emails with business documents or invoices. These emails include spoofed links that mimic Dynamics 365 Customer Voice communications, such as voicemails or PDF files. According to Check Point, over 3,370 such phishing emails have been sent in the campaign so far.

Phishing tactics target vulnerable sectors

The attackers focus on financial and operational themes to enhance credibility, using subject lines referencing payment settlements, ALTA forms, EFT details, and closing disclosures. A deceptive layer is added by including Captcha verification pages that give recipients a false sense of security. Once verified, users are redirected to a fake Microsoft login page designed to capture their credentials.

Targets include educational institutions, nonprofits, media organizations, healthcare entities, and cultural institutions—sectors often lacking robust cybersecurity defenses.

The primary goal of the campaign is to harvest login credentials, which could lead to unauthorized access, internal account manipulation, data theft, and financial fraud. While Microsoft has acted swiftly to block many of the phishing sites, researchers warn that some malicious emails may have reached users before action was taken.

AI-powered defenses against phishing

Check Point reports that it has implemented new safeguards within its email security products to detect and prevent similar threats. Experts recommend that organizations update their cybersecurity measures with AI-powered, multi-layered email protection and educate staff on recognizing phishing tactics—especially those masquerading as trusted Microsoft communications.