Attackers Claim Identity of Financial NGO to Steal Sharepoint, Office Credentials

Attackers target investment brokers through phishing emails claiming to be from FINRA to steal Microsoft SharePoint and Office credentials. Campaign uses actual officer names and a fake domain 'broker-finra.org' to add credibility, prompting recipients to enter their passwords. In some cases, emails do not include attachment, possibly setting stage for follow-up with infected content. Recipients are urged to change their passwords and delete emails from 'broker-finra.org,' also verify suspicious emails. Not directly related to COVID-19, but similar tactics have been used in recent email campaigns masquerading as health organizations