Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

Tactics
TA0009

Sub-technique of
T1114


See: MITRE ATT&CK