Imagine an email lands in your inbox with the subject line "Internal case log issued under conduct policy". It says a code of conduct review has begun and asks you to open a personalised attachment to see the case materials. Most of us would feel a jolt of worry and click.
That is exactly what the criminals behind a recent large-scale phishing campaign were counting on. Microsoft's Defender Research team reported that it reached more than 35,000 users across 13,000 organisations in 26 countries. It ran over just two days in April, and although most targets were in the United States, the tactics are easy to reuse anywhere, including here.
Why it worked
These were not the clumsy, badly spelled emails we have learnt to spot. They used polished, professional templates, carried the recipient's organisation name and claimed to come from an authorised internal channel. Some even showed a green banner suggesting the message had been encrypted by a legitimate secure email service.
Clicking through led to a PDF, then a link, then a series of pages with CAPTCHA checks and reassuring status messages. The CAPTCHAs were probably there to hinder automated security scanning, while to a human they made the process feel more legitimate. The final page asked the victim to sign in with their Microsoft account to "continue the review".
That sign-in page is the trap. The attackers used an "adversary-in-the-middle" technique, which captures your login session as you sign in. In effect, they can walk into your account even if you have entered a correct password and a code.
It is not just code of conduct emails
The code of conduct story was simply the bait used this time. The real weapon is urgency, and the same approach can be dressed up in many other ways. Be just as suspicious of emails that claim to be:
an unpaid invoice or a payment that has failed
a HR matter, a complaint or a disciplinary notice
a security alert saying your account will be locked or suspended
a shared document you must open "immediately"
a tax, HMRC or regulatory notice with a deadline
a delivery problem or a missed parcel
a request from a senior colleague or your boss to act quickly and quietly
The wording will change, but the pattern is always the same. Something worrying, a tight deadline and a link or attachment that you are asked to open straight away.
What to do about it
Microsoft's guidance is practical and, for most small businesses, achievable:
Use authenticator apps for multi-factor authentication rather than text messages, and move to passwordless sign-in where your accounts support it.
Switch on Safe Links and Safe Attachments in Microsoft Defender for Office 365. If you use Microsoft 365 Business Premium, this protection is included but may not be configured.
Check your Exchange Online Protection and Defender settings against Microsoft's recommended baseline.
Train your team with realistic examples. Any email that creates pressure to act quickly should prompt a pause.
A simple rule for your team
If an email makes you anxious and pushes you to act quickly, stop. Do not use the link in the message. Contact the sender by another route, such as a phone call or a message in Teams, and ask whether it is genuine. A genuine request will still be there ten minutes later.
If you think someone in your business has already entered their details on a page like this, change the password straight away, sign the account out of all sessions and speak to your IT support provider without delay.
The Chamber will continue to share timely warnings like this one. If your business would like help reviewing its email security settings, my own company, Martin Mann IT, supports small businesses across Harrogate and beyond with Microsoft 365 security, and I'm happy to help. Visit mann.solutions.
Support and advice is also available from any of our other IT members.
Martin Mann
Business Owner - Martin Mann IT Ltd
Source: Infosecurity Magazine, 5 May 2026, reporting on Microsoft Defender Research findings.
