Storm-1167

Storm-1167 is a threat activity cluster tracked by Microsoft that conducts adversary-in-the-middle phishing against Microsoft 365 users. Its operations steal credentials and authenticated session cookies or tokens by relaying legitimate authentication flows through fraudulent Microsoft sign-in pages. Reusing the resulting session material enables access to email and cloud services after victims complete multifactor authentication. The cluster is associated with FlowerStorm phishing infrastructure. Storm-1167 exploits trusted business relationships by sending phishing messages from compromised organizational and third-party email accounts. After compromising an account, it distributes additional credential-harvesting messages to internal users and external contacts, extending the intrusion through trusted correspondence. In an October 2023 incident, it sent more than 1,000 phishing messages from a compromised third-party account and approximately 1,300 additional messages from a compromised internal account. It also creates mailbox rules that move selected messages into designated folders to conceal malicious activity and delay detection. Associated phishing activity uses document-sharing and procurement-themed lures, counterfeit Microsoft authentication pages, and CAPTCHA gates. Microsoft’s Storm designation identifies a developing activity cluster rather than establishing a particular motivation or state affiliation.