A phishing campaign abuses the use of inclusive language involving words ending with the ".es" domain suffix. Attackers register these domains (e.g., intervenant.es, conferencier.es) to host fake Microsoft 365 login pages or fake browser extension installation pages. This technique leverages legitimate-looking URLs embedded in emails, exploiting the trust in internal communications and third-party partners. The campaign is passive and difficult to detect due to the legitimate appearance of the links and the context of inclusive language usage.

Users may be tricked into visiting malicious websites that impersonate Microsoft 365 login portals or prompt installation of malicious browser extensions. This can lead to credential theft or compromise of user devices. The threat targets internal communications and trusted third-party emails, increasing the likelihood of successful phishing without raising immediate suspicion.

No official patch or fix is applicable as this is a phishing technique rather than a software vulnerability. Organizations should educate users about the risk of clicking on unexpected or unusual links, even if they appear to use inclusive language or come from trusted partners. Email filtering and URL reputation services may help detect and block such malicious domains. Monitoring for suspicious domain registrations related to inclusive language terms could also be beneficial.