Loading story…
Attackers used an HR-themed adversary-in-the-middle (AiTM) phishing lure to steal an authenticated Microsoft 365 session from a finance employee and hijack a shared accounts-payable mailbox, enabling a cloud-only business email compromise without malware. Investigators found the victim’s real Microsoft 365 login and MFA approval were relayed through the phishing page, after which the attackers replayed the captured session cookie from commercial VPN infrastructure; Microsoft 365 telemetry showed MFA as previously satisfied, and Entra ID logs recorded impossible-travel activity between Amsterdam and Los Angeles within about a minute.
With access to Exchange Online, SharePoint, Microsoft 365 Search, and finance mailboxes, the attackers monitored legitimate invoice workflows and carried out a roughly 30-day payment-diversion scheme using both vendor impersonation and internal look-alike-domain impersonation. They also created malicious inbox rules, deleted or hid collection notices and other messages that could reveal the fraud, while investigators correlated browser history, email headers, mailbox audit logs, and sign-in telemetry to confirm session-token replay and cloud account compromise.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
During the campaign, the attacker created concealment inbox rules to archive messages, mark them as read, stop processing them, and delete emails that could expose the scam, including vendor collection notices and impersonation threads. Mailbox audit logs also recorded MoveToDeletedItems, SoftDelete, and HardDelete activity, and around Day 29 a third concealment rule was added to suppress internal scrutiny.
From Day 21 through Day 24, the attacker impersonated a senior accounts-payable colleague using a look-alike domain to send internal-looking verification messages. These messages were used to push fraudulent banking updates for multiple vendors through the approval process.
From Day 2 through Day 22 of the intrusion, the attacker impersonated a vendor accounts-payable contact using a free webmail account and referenced about 20 legitimate outstanding invoices. The attacker pushed to change payments from paper checks to ACH and supplied fraudulent authorization and tax documents with attacker-controlled banking details.
Using commercial VPN infrastructure, the attacker replayed the stolen Microsoft 365 session and accessed Exchange Online, SharePoint, Microsoft 365 Search, and a shared accounts-payable mailbox through the victim's existing permissions. Telemetry showed MFA as previously satisfied, no new challenge, and an atypical-travel pattern between Amsterdam and Los Angeles about a minute apart.
A finance employee received a personalized HR-themed phishing email about a denied PTO request, clicked through a SendGrid-tracked link to a fake Microsoft 365 sign-in page, and approved MFA during an adversary-in-the-middle flow. The attacker captured the authenticated Microsoft 365 session token/cookie without deploying malware on the endpoint.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetrendaisecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A widespread phishing campaign is compromising **Microsoft 365** accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked **Storm-2755** (also known as **Payroll Pirates**), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows. Reporting also shows the intrusions can progress without additional device compromise, shifting instead into **identity-plane lateral movement** inside **Entra ID** and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through **Microsoft Graph**, register a malicious Entra ID application, create a service principal, grant permissions such as `Mail.Read` and `Mail.Send`, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including **OfficeHome error 90014**, anomalous Outlook sign-ins with **Firefox** user agents, repeated `SessionID` reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Aug 10, 2026
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026
Attackers ran a procurement-themed adversary-in-the-middle phishing campaign against universities, enterprises, multinational institutions, and organizations linked to the European Union and United Nations, using compromised Outlook accounts to resend lures from trusted internal or partner addresses. Victims were directed to fake document download portals with CAPTCHA stages and cloned Microsoft 365 login pages impersonating brands including **Microsoft**, **OpenGov**, **ConstructConnect**, and the **European Investment Bank**, enabling the theft of credentials, session cookies, and MFA-authenticated tokens in real time. Researchers said the operation relied on reverse-proxy phishing kits including **EvilProxy**, **FlowerStorm/Storm-1167**, and **Kali365** to bypass MFA and gain access to Outlook, SharePoint, and other Microsoft 365 resources. The infrastructure favored aged or compromised domains, RDGA-style phishing domains, phishing subdomain conventions, and injected PHP content on dormant websites, indicating an effort to evade detection by avoiding newly registered infrastructure; defenders were urged to use DNS and passive DNS visibility, Microsoft 365 sign-in monitoring, and conditional access controls because MFA alone does not stop session hijacking.
Jul 22, 2026