As reported by The Hacker News, an active, widespread adversary-in-the-middle (AitM) phishing campaign is targeting Microsoft 365 accounts with surgical precision — not for immediate account takeover, but to infiltrate financial workflows and harvest sensitive payroll and accounting communications.
Why This Campaign Stands Apart
Most phishing campaigns cast wide nets. This one uses a scalpel. The threat actors aren't simply stealing credentials — they're mapping organizational hierarchies and financial communication chains. That distinction is critical. Once attackers identify who approves wire transfers, manages payroll vendors, or controls ACH transactions, they possess everything needed to execute convincing business email compromise (BEC) fraud at scale.
The use of residential proxies is what elevates this campaign's operational sophistication. By routing malicious sign-in traffic through legitimate consumer IP addresses, attackers neutralize some of the most reliable detection signals available to security teams — geographic anomalies, hosting provider flags, and reputation-based IP blocking. To a SIEM or identity protection platform, these logins can appear indistinguishable from an employee working from home.
AitM attacks don't just steal passwords — they steal authenticated sessions, meaning MFA alone is no longer a reliable last line of defense. Session token theft is the quiet evolution of credential-based attacks that too many organizations haven't fully reckoned with.
Who Is at Risk
Any organization running Microsoft 365 with staff involved in financial operations should treat this as a direct threat. The highest-risk profiles include:
The Anatomy of the Threat: AitM + Session Harvesting
AitM phishing works by positioning a reverse proxy (often built on frameworks like Evilginx2 or Modlishka) between the victim and the legitimate Microsoft 365 login portal. The victim authenticates — including completing MFA — but the attacker simultaneously captures the authenticated session cookie. This gives the adversary a valid, MFA-cleared session without ever knowing the user's password.
Once inside, rather than acting immediately (which would trigger anomaly alerts), sophisticated actors observe. They read email threads, understand approval workflows, identify key vendors, and wait for the opportune moment to redirect a payment or modify payroll bank details. This reconnaissance phase is what makes financial losses from these campaigns so large — attackers strike at the right moment, not just the first opportunity.
Detection Challenges
Traditional indicators of compromise are deliberately undermined here. Residential proxies defeat IP reputation checks. Session token reuse may appear geographically plausible. Sign-in timing can mimic normal work hours. Defenders must shift toward behavioral analytics and focus on:
- Impossible travel based on session continuity, not just login location
- Unusual email access patterns — bulk reading of finance-related messages from a new device or client
- Email forwarding rule creation events shortly after authentication
- OAuth app consent grants appearing post-login
Shield53 Recommendations
Immediate Actions
- Deploy phishing-resistant MFA immediately: Transition away from OTP/push-based MFA to FIDO2 hardware keys or certificate-based authentication. These are the only MFA methods that defeat AitM session hijacking at the authentication layer.
- Enable Conditional Access with token protection: Microsoft's Token Protection (Conditional Access) policy binds session tokens to the device, making stolen tokens non-transferable. Enable this for finance and executive accounts as a priority.
- Audit and restrict email forwarding rules: Use Microsoft 365 Defender or PowerShell to enumerate all inbox forwarding rules organization-wide. Enforce a policy blocking external auto-forwarding at the transport layer.
- Review sign-in logs for residential proxy indicators: Cross-reference Microsoft Entra ID sign-in logs against known residential proxy IP ranges using threat intelligence feeds. Flag and investigate any financial team logins sourced from ASNs associated with proxy services.
- Implement Continuous Access Evaluation (CAE): CAE allows Microsoft 365 to revoke sessions in near real-time when risk signals are detected, significantly reducing the window of exploitation from stolen tokens.
Strategic Controls
- Establish out-of-band verification procedures for any changes to payroll bank accounts or high-value payment instructions — email alone should never be sufficient authorization.
- Deploy Microsoft Defender for Cloud Apps to monitor anomalous OAuth activity and unusual mail access patterns across your M365 tenant.
- Conduct targeted security awareness training for finance and payroll teams specifically focused on AitM phishing and vendor impersonation scenarios.
Broader Implications
This campaign is a clear signal that the threat actor ecosystem has matured. Commodity phishing actors are now deploying techniques — AitM frameworks, residential proxy infrastructure, behavioral reconnaissance — that were until recently the province of nation-state operators. The commoditization of these tools means every organization running Microsoft 365 with financially empowered employees must treat AitM-capable phishing as a baseline threat, not an advanced edge case. MFA is necessary but no longer sufficient. Identity security strategy must now extend to session integrity, token binding, and post-authentication behavior monitoring.
