Phishing Page with Exact Copy of Our Custom M365 Branding: Is This a Targeted Campaign or Automated?

Today a number of phishing emails got through our M365 Exchange/Defender filters. I analyzed the phishing links through a sandbox and observed that the phishing pages had the exact same custom branding elements—colors, company logo, and specific language—that were designed for our legitimate M365 login portal. The branding was intended to help our users distinguish authentic pages from malicious ones.

The phishing URLs are easy to spot that its malicious. However, I'm concerned our users will overlook the URL check …

automated branding campaign colors copy cybersecurity defender emails exchange language links logo m365 page phishing phishing emails sandbox today