Loading story…
Attackers ran a procurement-themed adversary-in-the-middle phishing campaign against universities, enterprises, multinational institutions, and organizations linked to the European Union and United Nations, using compromised Outlook accounts to resend lures from trusted internal or partner addresses. Victims were directed to fake document download portals with CAPTCHA stages and cloned Microsoft 365 login pages impersonating brands including Microsoft, OpenGov, ConstructConnect, and the European Investment Bank, enabling the theft of credentials, session cookies, and MFA-authenticated tokens in real time.
Researchers said the operation relied on reverse-proxy phishing kits including EvilProxy, FlowerStorm/Storm-1167, and Kali365 to bypass MFA and gain access to Outlook, SharePoint, and other Microsoft 365 resources. The infrastructure favored aged or compromised domains, RDGA-style phishing domains, phishing subdomain conventions, and injected PHP content on dormant websites, indicating an effort to evade detection by avoiding newly registered infrastructure; defenders were urged to use DNS and passive DNS visibility, Microsoft 365 sign-in monitoring, and conditional access controls because MFA alone does not stop session hijacking.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In May 2026, attackers ran an adversary-in-the-middle phishing campaign using compromised Outlook mailboxes to resend procurement-themed lures from trusted addresses. The operation targeted universities, enterprises, multinational institutions, and organizations linked to the European Union and United Nations to steal Microsoft 365 session cookies and MFA-authenticated tokens.
Infoblox disclosed a detailed analysis of a sophisticated 2026 procurement-themed AiTM phishing campaign, describing the use of fake document portals, CAPTCHA stages, cloned login pages, and multiple phishing kits including EvilProxy, FlowerStorm/Storm-1167, and Kali365. The report also highlighted infrastructure patterns such as aged compromised domains, RDGA-style domains, and injected PHP content on dormant websites.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 3, 2026
Attackers are abusing Outlook calendar invites in an active **CalPhishing** campaign to hijack Microsoft 365 accounts by delivering malicious `.ics` files that automatically place tentative meetings on victims’ calendars. Researchers at Fortra Intelligence and Research Experts (FIRE) said the invites impersonate urgent administrative notices such as Microsoft 365 domain renewal warnings and digital-signature invoice requests, with manipulated `SUMMARY`, `LOCATION`, and `DESCRIPTION` fields directing users to fake Microsoft 365, GoDaddy, or DocuSign pages. Because the calendar entry can remain visible even if the original email is deleted or sent to junk, the lure continues to generate trusted reminders and increases the chance of user interaction. The campaign uses HTML landing pages and redirect chains through **Cloudflare** to reduce detection, and researchers believe the operators are likely using the **EvilTokens** phishing kit sold on Telegram to automate the attacks. FIRE warned that the activity appears to incorporate **ConsentFix**-style device code phishing to steal session tokens rather than just passwords, allowing attackers to bypass **MFA** and maintain access to compromised accounts. The combination of trusted calendar workflows, persistent invites, and likely AI-assisted automation makes the technique a significant threat to enterprise account security and data privacy.
Jun 29, 2026
Attackers are abusing legitimate Microsoft 365 collaboration features to deliver phishing lures that look like routine internal activity, according to Fortra researchers. The campaign uses attacker-controlled or compromised Microsoft 365 Groups to add victims into spaces named like **IT Support**, **HR Updates**, or **All Company**, then pushes follow-on lures through group mailboxes, shared files, welcome messages, and calendar invitations. Messages are framed around urgent business themes such as payroll, contracts, supplier requests, and mandatory training to blend into normal workplace workflows and lower suspicion. A key tactic is **CalPhishing**, in which malicious `.ics` calendar events are used to place phishing items directly on a victim’s calendar and generate repeated reminders over time. Researchers said the repeated exposure across email, groups, files, and calendar surfaces can make the lure appear to be a legitimate unfinished task, while the end goals include credential theft, token capture, malware delivery, data exposure, and further social engineering. Because the activity is distributed across trusted Microsoft infrastructure, investigations are more complex; defenders were advised to review the full chain of group creation, membership changes, shared content, and lingering calendar entries, and to consider blocking the sender domain `groups.outlook.com` where appropriate.
Jun 29, 2026