## Investigation: Credential Harvesting

**Goal**: Steal username/password.

### Mechanism
1.  **The Hook**: "Your Office 365 password has expired. Click here to keep same password."
2.  **The Line**: Link goes to `microsoft-login-secure.com` (Phishing Site).
3.  **The Sinker**: Site looks 100% like Microsoft. User types creds. Site saves them and redirects user to real Microsoft.

### Indicators
*   **URL Analysis**: Look at the domain. Is it `microsoft.com`?
*   **HTTPS**: Phishing sites DO use HTTPS (Green lock). Keys are free from Let's Encrypt. Do not trust the lock.
*   **Brand**: Use of official logos.