The case, which was publicized by Check Point Research as an educational tool, offers a fascinating glimpse behind the scenes of a digital crime ring.

Like all phishing attacks, this one began with fraudulent email templates. In this case, the messages mimicked Xerox scan notifications and included a target company employee’s name or title in the subject line.

The bogus emails were sent through accounts that had been previously compromised so they would appear to be from legitimate sources. This is why you’re often warned that phishing attacks may appear to come from your boss—or your mom.

The payload

The attackers attached an HTML file containing embedded JavaScript code that had one function; it secretly conducted background checks of victims’ password use. When this snooping software detected credential input, usernames and passwords were harvested, and unsuspecting users were sent to legitimate login pages.

The key here is that in order for all this to take place, email recipients had to fall for the phishing message and click the HTML file. That’s a major error.

Apparently, though, it’s a mistake many people make—in this particular campaign, attackers successfully bypassed Microsoft Office 365 Advanced Threat Protection filtering and stole more than 1,000 corporate employees’ credentials, researchers noted.

Keep in mind that the world only learned of this phishing attack because the hackers failed to tie up a few loose ends, leaving a digital trail of their crime. That’s why it’s up to you to educate yourself about phishing, spotting the attacks … and never, ever clicking on links unless you’re certain of their legitimacy.