Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Summary: Arctic Wolf Labs reported an active email-driven phishing campaign using adversary-in-the-middle techniques to take over Microsoft 365 accounts, targeting hundreds of organizations last month across healthcare, education, manufacturing, government, and professional services in the U.S., Canada, and Europe. The campaign uses voicemail-themed emails and a six-stage redirection chain through Google Meet, Google Ads, and Amazon S3 to reach decoy pages that capture credentials and MFA codes, then maintains stolen sessions at roughly eight-hour intervals from rotating residential proxies.
Key Takeaway: The attackers restricted themselves to session maintenance, reconnaissance, and mailbox collection, avoiding MFA changes, inbox rules, and lateral phishing, so the account-modification and outbound-email signals most BEC detections rely on never fire. With 11 to 24 hours passing before automated sign-ins recur, the link back to the original phishing email is easy to miss.

Read the original at The Hacker News ↗