Loading story…
CSO Online reported a new phishing campaign designed to trick employees into bypassing Microsoft 365 MFA, underscoring that attackers continue to target identity controls through social engineering rather than purely technical exploits. In parallel, PayPal described efforts to move customers away from SMS-based MFA, reflecting broader industry recognition that SMS is vulnerable to interception, SIM swapping, and user manipulation, and that stronger phishing-resistant authentication options are increasingly necessary.
Other items in the set were not part of a single, specific incident: one was a broad weekly roundup mixing AI, deepfakes, ransomware, and policy items, and another was a career-focused feature for CISOs. A separate CSO Online piece on a NIST initiative related to agentic AI is policy/strategy-oriented and not directly tied to the Microsoft 365 phishing activity or PayPal’s MFA changes, so it does not materially contribute to an incident-level briefing on MFA bypass threats.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
PayPal was reported to be making a new effort to move away from SMS-based multi-factor authentication. The reference frames this as a current product and security initiative without more specific event timing.
A reported phishing campaign was highlighted that tricks employees into bypassing Microsoft 365 multi-factor authentication protections. The reference provides no further timing details beyond the publication window.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adversary-in-the-middle (**AiTM**) phishing continues to undermine traditional MFA by proxying legitimate Microsoft sign-in flows in real time, allowing attackers to capture not only passwords but also **session tokens** and MFA responses. One investigation described how sophisticated redirect infrastructure (e.g., unusually deep redirect chains) can place the final phishing content beyond the reach of many email security scanners, and how **one-time URL tokens** can prevent defenders from reproducing the full chain after the fact—making *in-the-moment* evidence collection critical. The same analysis emphasized that **phishing-resistant MFA** (e.g., **FIDO2/passkeys**) is a more effective control because hardware-bound credentials cannot be relayed through a proxy. Operationally, defenders are being pushed to treat modern phishing as an infrastructure and workflow problem, not just a user-awareness issue: attackers increasingly use HTTPS, branded lookalike pages/domains, redirects, and short-lived links to evade detection, including **QR phishing** (codes embedded in PDFs that bypass URL scanning). Additional pressure tactics like **MFA fatigue** (push-spam) remain effective against push-based MFA, with mitigations including number matching, contextual prompts (e.g., location), and monitoring for abnormal push rates. For earlier detection of AiTM activity, one proposed tripwire is embedding **Canary Tokens** in Microsoft Entra ID tenant branding (e.g., custom CSS) to alert when an AiTM proxy loads the login page, while noting this is not universally reliable across all kits.
Jun 29, 2026
A wave of sophisticated phishing campaigns is targeting organizations globally to steal Microsoft 365 credentials by bypassing traditional email security gateways and multi-factor authentication (MFA) protections. Attackers are employing advanced techniques such as multi-stage payload delivery using nested PDF attachments, legitimate content delivery networks, and mouse tracking to evade detection. Once victims interact with these emails and enter their credentials on a credential harvesting site, attackers leverage legitimate Microsoft infrastructure to bypass MFA and gain immediate access to the victim’s Microsoft 365 environment. These campaigns are engineered to filter out security analysts and block standard security tools, making detection and response more challenging. In parallel, threat actors are increasingly using attacker-in-the-middle toolkits like Evilginx and hybrid phishing-as-a-service kits such as Salty2FA and Tycoon2FA to capture both user credentials and session cookies. By stealing session cookies, attackers can impersonate users and maintain access without triggering additional MFA prompts, even after successful authentication. The blending of different phishing kits into hybrid strains is making detection harder, as traditional security rules tuned to individual kits are now being evaded. Security researchers warn that static indicators are no longer sufficient, and behavioral analysis is required to spot these evolving threats.
Jun 29, 2026
Recent high-profile breaches at major UK retailers, including M&S and Co-op Group, have highlighted the growing threat of identity-based attacks. Attackers used vishing techniques to obtain corporate passwords, which enabled ransomware deployment and resulted in significant financial and reputational damage. The distributed nature of modern IT environments, with resources spread across cloud and on-premises systems, has made identity the new security perimeter, increasing the value of credentials for cybercriminals. Infostealer malware and various forms of phishing, including smishing and vishing, are now primary methods for harvesting credentials, contributing to a surge in identity-related breaches across industries. To counter these threats, security experts emphasize the importance of robust multifactor authentication (MFA), particularly methods that are resistant to phishing. While traditional MFA methods such as one-time passwords (OTPs) sent via SMS or email are still widely used, they are increasingly vulnerable to social engineering and interception. The adoption of passkeys and other phishing-resistant MFA solutions is being promoted as the gold standard, with Microsoft reporting that MFA blocks over 99% of unauthorized access attempts. Organizations are urged to move beyond basic MFA and implement stronger, phishing-resistant authentication to protect against evolving identity-based attacks.
Jun 29, 2026