Hi all. Have a user with fully patched Outlook 2016 connected to Office 365/Exchange. Today a yellow banner displayed across the top as follows: (also see attachment)
"Check your connection To get new email, use your browser to sign in to CET52601". then next to that an Open Browser button, That button then loads a page about the Coronavirus with a download that is obviously malichous. The URL shows up as:msftconnecttest\redirect The Intenet stays conencted the whole time.
The banner displayed in the same area that a problem with the Microsoft subscription would normally appear. I disabled macros and checked for extra add-ins and it still pops up. CET52601 is the name of her WiFi network. The user is working from home.
Any ideas what's been compromised here? I'm thinking it might be a normal Outlook message when a portal has to be used...