Both platforms use phishing portals mimicking legitimate login pages (e.g., Microsoft) to harvest credentials and MFA tokens, relying on backend servers hosted on domains like .ru and .com.
with victims being redirected to phishing pages mimicking Microsoft 365 login portals, designed to steal user credentials. Two-step phishing attacks layer malicious actions to evade detection.