Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
An active AitM phishing campaign targets M365 accounts of payroll and finance staff to intercept financial communications — a refined BEC precursor requiring token-binding defences.
Summary written by editorial AI · Source link below
Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email.
"The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,
Editorial Analysis
By specifically targeting financial workflow personnel, attackers are refining BEC tactics with session-token theft, making phishing-resistant MFA and token-binding essential, not optional.
Enable Conditional Access token-binding and continuous access evaluation for M365 sessions, especially for finance teams.
Phishing campaigns are now stealing live M365 sessions from finance staff, requiring stronger authentication controls to prevent funds diversion.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d