Information and data between individuals and organizations is most often worked on through online collaboration platforms (i.e. Microsoft SharePoint, Google Docs, DocuSign, etc). Instead of sending this information as an attachment, data is shared through email using links to documents. And, when accessing this information, users must first use their corporate credentials to authenticate and login to the platform.
Threat actors use phishing emails, impersonating legitimate collaboration platforms with links to credential harvesting webpages, stealing credentials. Once the threat actor has gained access to corporate credentials, they can take the compromised passwords to steal personal information and corporate information, resulting in data breaches.