AI-Powered Presentation Tool Gamma Implicated in Multi-Stage Phishing Campaign

Summary

Attackers reportedly exploited Gamma, an AI-powered presentation tool, to create convincing presentation pages that hosted links to a spoofed Microsoft SharePoint login portal. The phishing flow allegedly used compromised email accounts, Cloudflare Turnstile for bot evasion, and adversary-in-the-middle (AiTM) tactics to validate credentials in real time and capture session cookies. The campaign aimed to bypass MFA and compromise accounts.

Developers

• Gamma

Deployers

• Unknown threat actors
• Unknown threat actors leveraging Gamma
• Unknown AiTM phishing campaign actors

Harmed parties

• Gamma
• Microsoft
• Microsoft SharePoint users
• Recipients of phishing emails sent from compromised accounts
• Enterprises relying on Microsoft 365 and identity services
• Organizations whose employees interacted with Gamma-hosted phishing content

Tags

• Credential theft
• Social engineering
• Brand impersonation
• Unauthorized access
• Trust exploitation
• Security system evasion
• Email
• Enterprise collaboration tools
• Cloud-based productivity software
• Cybersecurity
• Identity and access management
• AI-powered presentation generation
• Generative design tools
• AI-assisted content creation
• Behavioral deception using AI-generated flows
• Living-off-trusted-sites (LOTS) attack
• Multi-stage redirection flow
• Adversary-in-the-middle (AiTM) phishing
• CAPTCHA spoofing
• Cloudflare Turnstile
• Microsoft
• Real-time credential verification
• Brand spoofing and UI mimicry
• Link obfuscation via presentation layer