Loading story…
Microsoft reported an adversary-in-the-middle (AiTM) phishing campaign targeting multiple energy-sector organizations by abusing Microsoft SharePoint file-sharing links to make lures appear legitimate and evade email-centric defenses. Initial emails—often sent from previously compromised, trusted accounts—used subject lines such as “NEW PROPOSAL – NDA” and directed recipients to a SharePoint URL that ultimately led to a fake login page designed to capture credentials and facilitate account takeover.
After victims authenticated, the attackers leveraged stolen credentials and intercepted authenticated session cookies to access mailboxes from different IP infrastructure (including 178.130.46.8 and 193.36.221.10). They then created inbox rules to delete incoming messages and mark emails as read, reducing the chance of detection while they launched follow-on phishing from the compromised accounts—sending hundreds of messages (including an instance of 600+ emails) to internal and external contacts and distribution lists based on recent email threads. The operators monitored responses, deleted out-of-office/undeliverable notices, and replied to legitimacy questions to sustain the campaign; Microsoft emphasized that password resets alone are insufficient, recommending revoking active session cookies, removing attacker-created inbox rules, and validating no unauthorized MFA changes were made.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage of Microsoft's findings included two attacker IP addresses for defenders to review in authentication logs. The reporting reinforced recommendations to hunt for suspicious sign-ins, session reuse, and attacker-created mailbox rules.
Microsoft published research describing the energy-sector AiTM and BEC campaign, warning that password resets alone are insufficient because stolen session cookies and attacker-made MFA changes can preserve access. The company advised defenders to revoke active sessions, remove malicious inbox rules, reverse unauthorized MFA changes, and strengthen protections with conditional access and phishing-resistant authentication.
Microsoft Defender XDR detected the activity across affected organizations, and Defender Experts took response actions including disrupting the AiTM activity and purging phishing emails. Microsoft also identified compromised users using sign-in and landing IP telemetry patterns.
After gaining access, the attackers created malicious inbox rules to delete or mark messages as read, monitored mailboxes, and used compromised accounts to send follow-on phishing to internal and external contacts. In at least one observed case, a single compromised account sent more than 600 phishing emails and the operators replied to skeptical recipients while deleting evidence to preserve credibility.
A multi-stage phishing campaign targeted multiple energy-sector organizations using SharePoint file-sharing lures sent from a trusted vendor or other previously compromised email account. Victims were redirected to an adversary-in-the-middle login page that captured credentials and authenticated session cookies, enabling account takeover and MFA bypass.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcesecurityonline.info
Open sourcego.theregister.com
Open sourcehelpnetsecurity.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used an HR-themed adversary-in-the-middle (**AiTM**) phishing lure to steal an authenticated Microsoft 365 session from a finance employee and hijack a shared accounts-payable mailbox, enabling a cloud-only business email compromise without malware. Investigators found the victim’s real Microsoft 365 login and MFA approval were relayed through the phishing page, after which the attackers replayed the captured session cookie from commercial VPN infrastructure; Microsoft 365 telemetry showed MFA as previously satisfied, and Entra ID logs recorded impossible-travel activity between Amsterdam and Los Angeles within about a minute. With access to Exchange Online, SharePoint, Microsoft 365 Search, and finance mailboxes, the attackers monitored legitimate invoice workflows and carried out a roughly 30-day payment-diversion scheme using both vendor impersonation and internal look-alike-domain impersonation. They also created malicious inbox rules, deleted or hid collection notices and other messages that could reveal the fraud, while investigators correlated browser history, email headers, mailbox audit logs, and sign-in telemetry to confirm session-token replay and cloud account compromise.
Aug 21, 2026
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026
Attackers ran a procurement-themed adversary-in-the-middle phishing campaign against universities, enterprises, multinational institutions, and organizations linked to the European Union and United Nations, using compromised Outlook accounts to resend lures from trusted internal or partner addresses. Victims were directed to fake document download portals with CAPTCHA stages and cloned Microsoft 365 login pages impersonating brands including **Microsoft**, **OpenGov**, **ConstructConnect**, and the **European Investment Bank**, enabling the theft of credentials, session cookies, and MFA-authenticated tokens in real time. Researchers said the operation relied on reverse-proxy phishing kits including **EvilProxy**, **FlowerStorm/Storm-1167**, and **Kali365** to bypass MFA and gain access to Outlook, SharePoint, and other Microsoft 365 resources. The infrastructure favored aged or compromised domains, RDGA-style phishing domains, phishing subdomain conventions, and injected PHP content on dormant websites, indicating an effort to evade detection by avoiding newly registered infrastructure; defenders were urged to use DNS and passive DNS visibility, Microsoft 365 sign-in monitoring, and conditional access controls because MFA alone does not stop session hijacking.
Jul 22, 2026