Several versions of a similar phishing message were sent out on August 25th, 2026.
Send details - lucy ken version
Date Sent: Aug 25, 2026, 1:26pm EDT
From: SharePoint Online <no-reply[@]sharepointonline[.]com> (SharePoint is a legitimate Microsoft product that can be leveraged by threat actors to share malicious content)
Reply to: <lucyken[@'kiszewozs[.]oborniki.pl>
Subject: lucy ken shared "Mount Holyoke College 2026 Fall Resumption Faculty & Staff latest employee benefits" with you
Send details - charles wood version
Date Sent: Aug 25, 2026, 1:27pm EDT
From: SharePoint Online <no-reply[@]sharepointonline[.]com> (SharePoint is a legitimate Microsoft product that can be leveraged by threat actors to share malicious content)
Reply to: <charleswood[@]edu[.]oborniki[.]pl>
Subject: charles wood shared "Mount Holyoke College 2026 Fall Resumption Faculty & Staff latest employee benefits" with you
Message
lucy ken/charles wood (depending on which version you got) shared a file with you
Here's the document that lucy ken/charles wood shared with you. [Malicious link removed]
Mount Holyoke College 2026 Fall Resumption Faculty & Staff latest employee benefits [Malicious link removed]
This link only works for the direct recipients of this message.
Open
This email is generated through Gmina ObornikiEDU's use of Microsoft 365 and may contain content that is controlled by Gmina ObornikiEDU.
Link destination
If you clicked on the linked text "Mount Holyoke College 2026 Fall Resumption Faculty & Staff latest employee benefits" in either version to try and view the file, you'd be taken to a Microsoft login screen that sought to compromise your MHC Account credentials.
