Threat actors abuse Proofpoint and Intermedia link wrapping to deliver phishing emails and steal Microsoft 365 credentials.

UNC4899 used job lures and cloud exploits to breach two firms, steal crypto, and embed malware in open source.