Loading story…
IEH Corporation, a US defense and aerospace supplier and military device manufacturer, disclosed that attackers accessed an employee's Microsoft 365 mailbox after a phishing campaign used a fake Microsoft sharing link and counterfeit login page to steal credentials. The compromised inbox contained email messages, attachments, customer communications, purchase orders, engineering documentation, and potentially export-controlled technical information, giving the intruder access to sensitive business and technical materials during the period of compromise.
The company said it discovered the intrusion on August 4 and moved to secure the account, disable malicious mailbox rules, preserve evidence, and review Microsoft 365 security controls and authentication protections. IEH reported no evidence of data exfiltration or operational disruption and said it does not currently expect a material business impact, although the investigation and corrective actions remain ongoing.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
IEH discovered the intrusion on August 4 and responded by securing the compromised account, disabling malicious mailbox rules, preserving evidence, and starting corrective actions. The company also began reviewing Microsoft 365 security controls and authentication protections.
IEH disclosed the cybersecurity incident in a Form 8-K filing with the U.S. Securities and Exchange Commission. The company said it had found no evidence of data exfiltration, operations were not disrupted, and it did not currently expect a material impact while the investigation continued.
As part of its response to the Microsoft 365 mailbox compromise, IEH notified relevant law enforcement authorities and launched an investigation with assistance from external cybersecurity experts. The company also said it activated incident response and business continuity procedures while reviewing whether affected parties or regulators must be notified.
IEH said an attacker impersonated a prospective business contact, used a fake Microsoft sharing link and counterfeit login page, and gained access to one employee's Microsoft 365 mailbox. The accessible mailbox contents included emails, attachments, customer communications, purchase orders, engineering documentation, and potentially export-controlled technical information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used an HR-themed adversary-in-the-middle (**AiTM**) phishing lure to steal an authenticated Microsoft 365 session from a finance employee and hijack a shared accounts-payable mailbox, enabling a cloud-only business email compromise without malware. Investigators found the victim’s real Microsoft 365 login and MFA approval were relayed through the phishing page, after which the attackers replayed the captured session cookie from commercial VPN infrastructure; Microsoft 365 telemetry showed MFA as previously satisfied, and Entra ID logs recorded impossible-travel activity between Amsterdam and Los Angeles within about a minute. With access to Exchange Online, SharePoint, Microsoft 365 Search, and finance mailboxes, the attackers monitored legitimate invoice workflows and carried out a roughly 30-day payment-diversion scheme using both vendor impersonation and internal look-alike-domain impersonation. They also created malicious inbox rules, deleted or hid collection notices and other messages that could reveal the fraud, while investigators correlated browser history, email headers, mailbox audit logs, and sign-in telemetry to confirm session-token replay and cloud account compromise.
Aug 21, 2026
A widespread phishing campaign is compromising **Microsoft 365** accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked **Storm-2755** (also known as **Payroll Pirates**), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows. Reporting also shows the intrusions can progress without additional device compromise, shifting instead into **identity-plane lateral movement** inside **Entra ID** and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through **Microsoft Graph**, register a malicious Entra ID application, create a service principal, grant permissions such as `Mail.Read` and `Mail.Send`, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including **OfficeHome error 90014**, anomalous Outlook sign-ins with **Firefox** user agents, repeated `SessionID` reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Aug 10, 2026
Researchers at Symantec and Carbon Black said unknown attackers maintained access for about five months to the Outlook mailbox of a senior executive at a major global stock exchange, quietly collecting email data from late 2025 into early 2026. The intruders used a custom mailbox-stealing tool built around the legitimate Aspose .NET library to convert the victim’s `OST` data into `PST` archives and repeatedly export the mailbox in small, date-bounded batches, indicating a deliberate intelligence-gathering operation rather than smash-and-grab theft. The stolen mailbox data was exfiltrated through Dropbox and OneDrive Personal to blend into ordinary cloud traffic, while persistence was hidden behind scheduled tasks and binaries masquerading as Adobe, Lenovo, and OneDrive components. Investigators also found tooling linked to tunneling, credential dumping, password recovery, and `UAC` bypass, along with hard-coded Microsoft IP addresses used to avoid OneDrive DNS lookups; attribution and the initial access vector remain unknown, but the incident shows how a single compromised executive mailbox can expose negotiations, calendars, contacts, travel plans, and other potentially market-sensitive information.
Jun 29, 2026