Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
An ongoing "widespread email-driven phishing campaign" that uses adversary-in-the-middle (AitM) techniques to gain control of Microsoft 365 accounts in order to identify key workers involved in financial workflows and collect associated emails has drawn notice from cybersecurity specialists.
According to Arctic Wolf Labs, the campaign disguises harmful sign-ins as legitimate customer traffic by using residential proxies. At around eight-hour periods, compromised sessions are maintained via automated activities.
Organizations in the U.S., Canada, and Europe in the fields of healthcare, education, manufacturing, government, and professional services are evaluated for the impact of the activity. It has tactical similarities to Payroll Pirate attacks, which Microsoft is monitoring under...