This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Threat actors are weaponizing the AI-powered presentation tool Gamma to host phishing redirect pages. By leveraging the platform's legitimate domain and reputation, attackers bypass security scanners and trick users into visiting spoofed Microsoft SharePoint login portals. The campaign utilizes adversary-in-the-middle (AiTM) techniques to validate credentials in real time and capture session cookies, enabling unauthorized account access.
Attackers reportedly exploited Gamma, an AI-powered presentation tool, to create convincing presentation pages that hosted links to a spoofed Microsoft SharePoint login portal. The phishing flow allegedly used compromised email accounts, Cloudflare Turnstile for bot evasion, and adversary-in-the-middle (AiTM) tactics to validate credentials in real time and capture session cookies. The campaign aimed to bypass MFA and compromise accounts.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The phishing campaign successfully harvests sensitive Microsoft login credentials and session cookies, compromising user account privacy.
The incident involves threat actors using an AI platform to host highly convincing phishing pages to steal user credentials and session cookies for personal gain.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident is caused by human threat actors who intentionally abuse the deployed Gamma AI platform to host malicious phishing redirectors.
Threat actors are weaponizing the AI-powered presentation tool Gamma to host sophisticated phishing redirect pages and harvest Microsoft SharePoint credentials. While the technique represents an evolved cyber threat that bypasses traditional security filters, its overall national security impact remains minor and manageable within standard cybersecurity procedures.
The AI system, Gamma, acts as a tool that performs the specific function of generating presentations and web pages based on direct user inputs and templates.
Limited Risk: Gamma is an AI-powered content generation platform used to create presentations and websites. Under the EU AI Act, systems that generate or manipulate content (AI-generated content) are classified as Limited Risk and are subject to transparency obligations.
Gamma is an AI-powered online presentation and document builder that assists users in generating structured text, slides, and web layouts from prompts.
The reports are consistent, detailed, and from reputable cybersecurity sources (Abnormal Security, Dark Reading, etc.). They clearly outline the attack vector, the role of the AI platform, and the security implications.
None
Technology
AI Website Cloning Feature
Gamma allows cloning websites from URLs, easing phishing page creation.
Real-time AiTM Framework
Captures credentials and session cookies to bypass MFA protections.
Cloudflare Turnstile Abuse
Legitimate CAPTCHA blocks security scanners and increases trust.
Data Inputs
Legitimate Compromised Accounts
Initial emails sent from hacked accounts pass SPF/DKIM checks.
Trusted Domain Whitelisting
Security tools whitelist gamma.app, allowing malicious links to pass.
Impersonated Brand Assets
Use of official logos on Gamma pages increases perceived legitimacy.
Human Factors
Trust in Familiar Security Checks
Users trust Cloudflare Turnstile, lowering their suspicion.
Unfamiliarity with Gamma Platform
Users do not recognize Gamma, failing to spot it as an exploit vector.
Afternoon Alertness Slump
Timing of attacks during late afternoon exploits lower employee alertness.
Process and Methods
Multi-Stage Redirection Path
Layered redirection hides the final destination from static analysis tools.
Out of Platform Link Sharing
Copying links instead of sending via Gamma bypasses content scanning.
Lack of Outbound Warning Banners
Gamma lacked warning banners when redirecting users to external sites.
Management
Inadequate Abuse Detection Systems
Platform lacked robust processes to detect and disable malicious content.
Lag in Security Training Updates
Cybersecurity education fails to cover lesser-known tools like Gamma.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
