iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a campaign that peaked in June 2024 and was still active in September, attackers used DocuSign-themed emails and legitimate HubSpot Free Form Builder pages to steer people at European manufacturing companies to fake Microsoft sign-in pages. Palo Alto Networks Unit 42 reported roughly 20,000 targeted users, but did not publish a complete count of confirmed Azure account takeovers. Unit 42 said HubSpot itself was not compromised in this campaign.
How the phishing chain worked
The campaign impersonated a familiar document-signing workflow to make a credential request look routine. Unit 42 documented activity against European automotive, chemical, and industrial-compound manufacturers, specifically identifying Germany and the UK. The activity peaked in June 2024 and remained active in September 2024.
- The email set the context. A victim received a DocuSign-themed message with either a PDF attachment or an embedded link.
- A HubSpot form page acted as an intermediary. The victim was directed to a HubSpot Free Form Builder page with wording such as “View Document on Microsoft Secured Cloud.”
- A click led to an attacker-controlled sign-in page. The form page redirected the victim to a fake Microsoft Outlook or Azure login page designed to collect credentials.
- The credentials could enable attempted account access. Unit 42 reported multiple Azure access attempts, but its report does not establish a complete number of successful account takeovers.
A legitimate HubSpot address at the start of the chain could make the first step less likely to be blocked by controls focused on suspicious domains. That does not make the final sign-in page legitimate: the credential-harvesting pages were controlled by the attackers.
Were manufacturing companies hacked through HubSpot?
Unit 42 described a phishing campaign that abused HubSpot Free Form Builder pages as part of its lure and redirect chain. It explicitly said HubSpot was not compromised in this campaign and that the Free Form Builder links were not delivered to victims via HubSpot infrastructure. The evidence therefore supports abuse of a legitimate service in a phishing flow, not a breach of HubSpot that exposed the targeted companies.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep this campaign separate from HubSpot’s own June 2024 security incident. HubSpot said its investigation found unauthorized access to fewer than 30 customer portals and that the incident was resolved by June 27, 2024. That separate incident is not evidence that it enabled this manufacturing-sector phishing campaign.
What does “roughly 20,000 targeted users” mean?
Roughly 20,000 is Unit 42’s published estimate of users targeted across various European companies, not a confirmed number of people who entered passwords or whose accounts were taken over. The report describes targeting and multiple Azure access attempts, but does not provide a complete confirmed-takeover count or a verified list of victims. Treat any claim that 20,000 Azure accounts were compromised as unsupported by this report.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do if someone entered an Azure password
Handle a suspected credential entry as an identity incident, even if there is not yet evidence of a successful sign-in. Microsoft’s compromised-identity guidance calls for containment, evidence preservation, and a review of changes made to the account and related services.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Contact the person through an approved channel. Do not rely on the potentially compromised mailbox or a reply to the suspicious message to verify what happened.
- Contain the identity. Revoke active sessions and refresh tokens, then force a password reset. If the exposed credential was a non-user secret, rotate it instead. A password reset alone should not be treated as proof that existing sessions or tokens are invalidated.
- Preserve sign-in evidence. Keep relevant sign-in and audit records, and identify the first successful malicious sign-in, if one occurred. Use that point to establish the time window for investigation.
- Check authentication changes. Review MFA method changes and remove authentication methods the user or administrators did not authorize. Re-register approved MFA methods when needed.
- Look for follow-on access. Review email changes, OAuth consent grants, and signs of lateral movement or other affected identities. Expand the investigation to connected resources if the evidence points beyond the initially reported account.
- Protect recovery and privileged access. Follow the organization’s approval process before disabling service principals or break-glass accounts; Microsoft’s guidance does not call for disabling them indiscriminately.
Preserve enough evidence to understand the access path while containment proceeds. Coordinate the investigation with the identity and security administrators responsible for the affected tenant.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Will a FIDO2 security key stop this kind of phishing?
A properly deployed FIDO2 security key is a phishing-resistant sign-in option: Microsoft describes FIDO2 keys and passkeys, along with Windows Hello for Business and certificate-based authentication, as options that use hardware-backed cryptographic keys. Unlike a password typed into a lookalike site, a phishing-resistant credential is designed to bind authentication to the legitimate service. It can therefore block the credential-harvesting step in this type of attack, provided the account is actually using the phishing-resistant method and the attacker cannot bypass it through another sign-in or recovery route.
No single authentication method replaces incident monitoring or sound account recovery. Organizations should ensure protections cover privileged identities as well as standard users, and review risky sign-ins and authentication-method changes. For privileged Microsoft Entra roles, Microsoft recommends a Conditional Access policy that requires phishing-resistant MFA and advises testing it in report-only mode before enforcement.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How organizations can reduce exposure
- Require phishing-resistant MFA for privileged identities. Apply the Conditional Access policy to the intended privileged users and roles, test it in report-only mode, then enforce it after confirming expected access and recovery paths.
- Extend stronger sign-in options beyond administrators. Use FIDO2 security keys, passkeys, Windows Hello for Business, or certificate-based authentication where appropriate, and make clear which identities are covered.
- Do not trust a familiar first domain as proof of safety. A reputable form or document service can be abused as an intermediary. Investigate the full redirect chain and the final destination when a document workflow asks for credentials.
- Monitor identity changes and sign-ins. Make risky sign-ins, new MFA methods, OAuth consent, and unusual email changes part of the incident review process.
- Prepare recovery procedures in advance. Define how to revoke sessions, reset passwords or rotate secrets, preserve evidence, remove unauthorized methods, and protect emergency-access accounts without disrupting approved recovery.
The campaign details above come from Palo Alto Networks Unit 42’s 2024 report. The response and prevention recommendations reflect Microsoft guidance checked on September 30, 2026; Microsoft’s administrator MFA guidance was updated March 24, 2026, and its incident-response template August 11, 2026.
Recommended Free Tools
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
