### Overview
Following the initial access gained through an MFA fatigue attack, the threat actors initiated a phishing campaign targeting Uber employees via Slack.

### Details
- **Objective:** The attackers aimed to harvest additional credentials and further compromise the internal network.
- **Tactics:**
  - Used convincing messages that mimicked Uber's IT department.
  - Embedded malicious links within the messages.

### Indicators of Compromise (IoCs)
- Unusual Slack message activity originating from compromised accounts.
- External IP addresses accessing internal Slack channels.

### Recommendations
- Conduct immediate awareness training for employees.
- Implement stringent verification for internal communications.