AiTM Phishing Bypassed Microsoft 365 MFA in Finance Mailbox BEC Fraud

Attackers used an HR-themed adversary-in-the-middle (AiTM) phishing lure to steal an authenticated Microsoft 365 session from a finance employee and hijack a shared accounts-payable mailbox, enabling a cloud-only business email compromise without malware. Investigators found the victim’s real Microsoft 365 login and MFA approval were relayed through the phishing page, after which the attackers replayed the captured session cookie from commercial VPN infrastructure; Microsoft 365 telemetry showed MFA as previously satisfied, and Entra ID logs recorded impossible-travel activity between Amsterdam and Los Angeles within about a minute.

With access to Exchange Online, SharePoint, Microsoft 365 Search, and finance mailboxes, the attackers monitored legitimate invoice workflows and carried out a roughly 30-day payment-diversion scheme using both vendor impersonation and internal look-alike-domain impersonation. They also created malicious inbox rules, deleted or hid collection notices and other messages that could reveal the fraud, while investigators correlated browser history, email headers, mailbox audit logs, and sign-in telemetry to confirm session-token replay and cloud account compromise.