Threat actors have begun taking advantage of the recent death of Queen Elizabeth II in a phishing campaign discovered by Proofpoint Threat Insight researchers. The campaign’s goal is to exfiltrate the victims’ multi-factor authentication (MFA) codes and compromise their Microsoft account credentials. On September 14, 2022, researchers posted on Twitter that the phishing campaign is impersonating “the Microsoft team” and attempting to lure victims to a fraudulent online memory board that includes “millions of memorable words and thousands of letters and photos.” The email’s subject contains “Join our AI space in memory of Queen Elizabeth II” and the email body includes links to a URL redirecting credential harvesting page. The researchers also noted that this campaign appears to be using the EvilProxy reverse-proxy Phishing-as-a-Service (PaaS) kit, which was reported in the September 6, 2022 FLASH Update. The United Kingdom’s National Cyber Security Center (NCSC) previously published an article on September 13, 2022, regarding potential scams rising during national mourning. Microsoft users must remain vigilant of threat actors attempting to take advantage of recent tragedies or big news stories, as these types of events will remain a common lure theme amongst phishing campaigns.