Gamma presentation tool exploited in phishing attacks targeting Microsoft credentials
Cybercriminals are exploiting Gamma, an AI-powered presentation platform, in multi-stage phishing campaigns that impersonate Microsoft SharePoint to steal login credentials. The attacks use compromised email accounts, Gamma-hosted presentations, and real-time credential validation to bypass security controls.
What happened
Cybersecurity researchers at Abnormal identified a multi-stage phishing campaign exploiting Gamma, an AI-powered online presentation builder. The attack begins with a generic phishing email sent from a legitimate but compromised email account, which helps bypass standard authentication checks like SPF, DKIM, and DMARC.
The email contains a PDF attachment that is actually a hyperlink to a Gamma-hosted presentation featuring the target organization's logo and a call-to-action button labeled 'View PDF' or 'Review Secure Documents.' Clicking the button leads to an intermediary splash page displaying Microsoft branding and a Cloudflare Turnstile bot detector.
After passing the Turnstile, users are presented with a phishing page that mimics Microsoft's SharePoint login portal. The attackers use an adversary-in-the-middle setup to validate credentials in real-time, allowing them to verify login attempts and potentially capture session cookies to bypass multi-factor authentication.
Reported impact
The attack is designed to steal Microsoft login credentials from targeted users and organizations. The researchers described the phishing flow as 'so polished it feels legitimate at every step.'
Index analysis
Abnormal researchers noted that Gamma's relative novelty as a platform, having only been around for a few years, makes it less likely to trigger suspicion compared to more widely recognized services like Docusign or Dropbox. The use of compromised legitimate email accounts bypasses content scanning and detection systems that organizations rely on.
Governance controls
The researchers noted that organizations are becoming familiar with file-sharing phishing attacks in general, but the percentage of companies that have updated their cybersecurity training to include attacks exploiting lesser-known platforms like Gamma is low.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.