Cybersecurity researchers have identified a widespread phishing campaign that employs adversary-in-the-middle (AitM) techniques to compromise Microsoft 365 accounts. The primary objective is to identify personnel involved in financial workflows and collect related emails.
The campaign utilizes residential proxies to mask malicious sign-ins, making them appear as ordinary consumer traffic. Automated activities maintain compromised sessions at approximately eight-hour intervals.
Organizations across sectors such as healthcare, education, manufacturing, government, and professional services in the U.S., Canada, and Europe have been affected. This activity shares similarities with the ‘Payroll Pirate’ attacks, which involve hijacking employee accounts to redirect salary payments to attacker-controlled accounts.
Attackers initiate the campaign by sending voicemail-themed phishing emails. These emails lead victims to AitM decoy pages that proxy the legitimate Microsoft account authentication flow, capturing credentials and multi-factor authentication (MFA) codes. The redirection chain employs trusted services like Google and Amazon S3 to bypass reputation-based filters.
The phishing pages use JavaScript to fingerprint the visiting host, gathering information about the browser, operating system, screen dimensions, language, time zone, and more. This data is sent to a PHP endpoint and then redirects the browser to the proxied Microsoft OAuth authorization endpoint.
Once access is obtained, attackers use the compromised sessions to collect emails from payroll and HR personnel involved in financial matters. Malicious sign-in activity often originates from residential proxy exit nodes in the victim’s country, indicating the use of geolocation data to select matching proxy infrastructure and evade security controls.
Notably, some sign-in events report unusual browser and operating system combinations, such as mobile versions of Apple Safari or Google Chrome on Windows 10.
To mitigate such threats, organizations should implement phishing-resistant MFA methods, monitor for suspicious sign-in activities, and educate employees about recognizing phishing attempts. Regularly updating security protocols and conducting awareness training are essential in defending against evolving phishing tactics.
