---
title: Phish Wire - April 3 2025
description: A record spearphish surge continued into the second half of March, particularly with Microsoft and Outlook credentials targeted via fileshare platforms like SharePoint, OneDrive, and Green Envelope.
image: https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%204325.png
---
[Skip to content](https://blog.identityautomation.com/phish-wire/phish-wire-april-3-2025#main-content)
[Identity Automation is now part of Jamf. Visit Jamf.com](https://jamf.com/)
- [Request a Demo](https://www.identityautomation.com/request-a-demo)
- [Contact Us](https://www.identityautomation.com/contact)
[](https://www.identityautomation.com)
Menu
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
# Phish Wire - April 3 2025
[by Identity Automation](https://blog.identityautomation.com/phish-wire/author/identity-automation)
A record spearphish surge continued into the second half of March, particularly with Microsoft and Outlook credentials targeted via fileshare platforms like SharePoint, OneDrive, and Green Envelope. Additionally, phishing campaigns targeting users of financial services like PayPal, American Express, Chase Bank, and Capital One continued their trend. We saw many additional targeted brands, like Netflix, but a viral Instagram phishing scheme stood out. Below are some examples and highlights.
- sec82\[.\]com\[.\]pl/login
- xn--dxtt24e\[.\]domains/doc818373737292200208373/share8287373792092039/index\[.\]html
- continue-authentication-0151\[.\]jotacicli\[.\]com\[.\]br
- amsurtoaseixcsec\[.\]com
- privatemessagie\[.\]de
- abiautismtherapy\[.\]spaceexplorationinnovations\[.\]de/WCerH/
- futurewebs\[.\]live/services\[.\]html
- thebengalurucompetition\[.\]ct\[.\]ws/en/1
- ywg\[.\]dwwrtw\[.\]ru
- msgiss\[.\]de/invitation/login/Greenenvelope/
- webfree\[.\]live/services\[.\]php
- share1nv1te\[.\]com/POINT/
- chcs\[.\]xyz/o/chaasee1/login
- gklnl\[.\]com/chase\[.\]verify/login
**Outlook Phishing via File Shares**
In mid-March, a staff member at a California organization clicked on an Outlook phishing email that was shared with them via OneDrive.
As is often the case, links clicked outside the purview of corporate email routinely evade the traditional phishing security ecosystem.
A similar Outlook phishing link was clicked by an employee of a Texas organization, this time via Green Envelope, an online invitation platform.
The period saw a record surge in similar attacks via various message-sharing applications outside of email. A few highlights are below, targeting users in Texas, Florida, and Kentucky.
.jpg)
**Viral Social Media Phishing**
One notable incident involved a phishing attack on Instagram, which was inadvertently engaged by a staff member at an organization in Kentucky.
The attack follows a reported pattern of “voting scams,” where compromised Instagram accounts send messages to their contacts, asking them to “vote for them in a Google online influencer competition.”
Source: [https://www.reddit.com/r/Instagram/comments/14du36k/voting\_scam\_from\_a\_friend](https://www.reddit.com/r/Instagram/comments/14du36k/voting_scam_from_a_friend)
This campaign spread virally through Instagram's messenger app, outside the scope of traditional email protection. The hacker utilized legitimate hosting infrastructure to launch the attack.
**Financial Services Phishing**
The same period extended the trend of phishing attacks on financial services, including Paypal “vishing” and stealthy Chase Bank phishing.
The PayPal phishing links contained tracking parameters in the URL, indicating they had been clicked in Google Ads campaigns.
**Actions **
- Block the specified domains on corporate firewalls and endpoint security solutions.
- Educate users about the risks of phishing in file-sharing applications, such as SharePoint and OneDrive, in addition to email.
- Remind users that personal accounts accessed on corporate devices also carry phishing risks.
- Instruct users to locate the valid support number for their financial institution through a Google search rather than calling numbers found on unverified web pages.
- Enforce multi-factor authentication (MFA) for all corporate logins to minimize the risk of credential compromise.
Dec 19, 2025
### Related Content
[All Resources](https://blog.identityautomation.com/phish-wire)
[](https://blog.identityautomation.com/phish-wire/phish-wire-october-28-2025)
Dec 19, 2025, 7:59:05 AM
##### [Phish Wire - October 28 2025](https://blog.identityautomation.com/phish-wire/phish-wire-october-28-2025)
In mid-October, there were remarkably widespread phishing campaigns, with a single OneDrive...
[](https://blog.identityautomation.com/phish-wire/phish-wire-july-8-2025)
Dec 19, 2025, 7:48:31 AM
##### [Phish Wire - July 8 2025](https://blog.identityautomation.com/phish-wire/phish-wire-july-8-2025)
The last week of June and early July saw a surge in zero-day phishing attacks targeting both...
[](https://blog.identityautomation.com/phish-wire/phish-wire-august-19-2025)
Dec 19, 2025, 7:55:07 AM
##### [Phish Wire - August 19 2025](https://blog.identityautomation.com/phish-wire/phish-wire-august-19-2025)
During the first half of August, there has been a significant increase in Microsoft support scams...
[](https://blog.identityautomation.com/phish-wire/phish-wire-mar-4-2025)
Dec 19, 2025, 7:40:49 AM
##### [Phish Wire - Mar 4 2025](https://blog.identityautomation.com/phish-wire/phish-wire-mar-4-2025)
In the past few weeks, we observed a rise in phishing activity targeting Microsoft, Google, and...
[.png?width=276&height=100&name=IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png "IA-a-Jamf-Company_stacked-darkmode@451x164 (1)")](https://www.identityautomation.com)
- Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
- [Knowledge Base](https://blog.identityautomation.com)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- DIR-CPO
- [DIR-CPO-4849](https://www.identityautomation.com/dir-cpo-4849)
- [DIR-CPO-5694](https://www.identityautomation.com/dir-cpo-5694)
[Contact Us](https://www.identityautomation.com/contact)
[Request A Demo](https://www.identityautomation.com/request-a-demo)
[Privacy Policy](https://www.identityautomation.com/privacy-policy)
[Terms & Conditions](https://www.identityautomation.com/terms-of-use)
© 2026 | All Rights Reserved
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Identity Automation",
"url" : "https://blog.identityautomation.com/phish-wire/author/identity-automation"
},
"dateModified" : "2025-12-19T13:43:07.634Z",
"datePublished" : "2025-12-19T13:43:07.000Z",
"headline" : "Phish Wire - April 3 2025",
"image" : [ "https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%204325.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.identityautomation.com/phish-wire/phish-wire-april-3-2025",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.identityautomation.com/hubfs/Singularity/logos/id-auto-logo-mark-black.svg"
},
"name" : "Identity Automation (A Jamf Company)"
}
}
```