Microsoft has disclosed details of a year-long social engineering campaign where operators kept changing their obfuscation and encryption mechanisms every 37 days on average, including relying on Morse code. The phishing attacks take the form of invoice-themed lures mimicking financial-related business transactions, with the emails containing an HTML file ("XLS.HTML"). The ultimate objective is to harvest usernames and passwords, which are subsequently used as an initial entry point for later infiltration attempts. "This phishing campaign exemplifies the modern email threat: sophisticated, evasive, and relentlessly evolving," Microsoft 365 Defender Threat Intelligence Team said in an analysis. The HTML attachment is divided into several segments and encoded in a variety of ways and includes “old and unusual encryption methods like Morse code, to hide these attack segments.” You can read the full technical analysis from Microsoft here.