🟠 High | Source: The Hacker News
Attackers are running a large-scale phishing campaign that uses adversary-in-the-middle (AitM) techniques to bypass multi-factor authentication and hijack Microsoft 365 accounts. Once inside, they specifically target staff involved in payroll and finance workflows to harvest sensitive emails and likely enable further fraud. Residential proxies are used to make the malicious logins appear as normal consumer traffic, helping evade detection.
Security Architect’s Take: Enforce phishing-resistant MFA (FIDO2/passkeys) across all Microsoft 365 accounts, particularly for finance and HR personas, and deploy Conditional Access policies that flag or block sign-ins from residential proxy ranges and unexpected locations. Review Entra ID sign-in logs for token replay indicators and anomalous session activity, and consider enabling Microsoft Defender for Office 365’s URL detonation and session anomaly alerts.
Original advisory: Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails