OneDrive Phishing Attack Targets Corporate Executives for Credential Theft

A newly discovered spearphishing campaign is targeting executives and senior leadership across multiple industries by exploiting trusted OneDrive document-sharing notifications.

According to Stripe OLT SOC, the attack uses highly tailored emails that impersonate internal HR communications to harvest corporate credentials via a convincing Microsoft Office/OneDrive login page, with subject lines referencing “Salary amendment” or “FIN_SALARY.” The emails appear to come from OneDrive’s document-sharing system and direct victims to a credential theft page that mimics Office 365, with the pages personalised to the recipient’s name and company.

The operation rotates among roughly 80 domains and subdomains using Amazon Simple Email Service for delivery, with domains registered through Mat Bao Corporation and Web Commerce Communications Limited (WebNic[.]cc) and hosting on Akamai Cloud (formerly Linode). The campaign employs anti-detection techniques, including hidden characters and obfuscated trigger words, and uses single-use phishing URLs that self-destruct on access; messages are sent days in advance to warm up inboxes.

Executives are urged to adopt layered controls, awareness, and threat hunting to mitigate this threat, as highlighted in the article dated 2 September 2025.