Phishing campaign leading to Azure account takeover

In June 2024, Unit 42 researchers identified a phishing campaign targeting approximately 20,000 users in European automotive, chemical, and industrial compound manufacturing sectors, particularly in Germany and the UK. The attackers employed fake forms created with HubSpot's Free Form Builder and malicious PDFs mimicking DocuSign documents to harvest account credentials and potentially take over victims' Microsoft Azure cloud infrastructure. The campaign remained active as of September 2024. Collaboration with HubSpot and DocuSign confirmed that their platforms were not compromised during these attacks.