Attackers use trusted entities to trick victims into giving up their corporate log-in details as well as to bypass security protections.
Source: Threadpost