AI-Powered Presentation Tool Gamma Implicated in Multi-Stage Phishing Campaign

Threat actors have been exploiting Gamma, an AI-powered presentation creation platform, to conduct sophisticated phishing attacks targeting Microsoft credentials. The attacks begin with emails sent from legitimate but compromised email accounts containing links disguised as PDF attachments. When clicked, these links redirect victims to presentations hosted on Gamma's legitimate domain (gamma.app) that feature the target organization's logo and call-to-action buttons labeled 'View PDF' or 'Review Secure Documents.' Clicking these buttons leads to an intermediary page with fraudulent Microsoft branding and a Cloudflare Turnstile bot detection tool. After completing the verification, victims are directed to a convincing fake Microsoft SharePoint login portal designed to harvest their credentials. Security researchers at Abnormal Security discovered that the attackers use adversary-in-the-middle (AiTM) techniques to validate credentials in real-time, displaying 'Incorrect password' errors for wrong credentials and potentially capturing multi-factor authentication tokens. The campaign exploits Gamma's relatively new status as a platform, making it less familiar to potential victims and security teams. This represents a 'living-off-trusted-sites' (LOTS) attack that leverages legitimate services to host malicious content and evade traditional security measures.