The attack methodology relies on adversary-in-the-middle (AiTM) techniques to intercept session tokens. Below is a concise overview of the operational details and indicators.

• Target scope: 258 unique organizations; more than 5,000 Microsoft 365 accounts compromised.
• Primary tactic: AiTM phishing to steal session cookies, allowing attackers to bypass MFA requirements.
• Payload focus: Microsoft 365 login pages, often using lookalike domains and urgency-based lures.
• Post-exploitation: Stolen sessions are typically used for data exfiltration and follow-up business email compromise (BEC).

Practical mitigation steps

• Enforce conditional access policies that require device compliance or trusted locations, not just a one-time password.
• Review sign-in logs for anomalous session activity, particularly where MFA was satisfied but geolocation or IP reputation appears suspicious.
• Implement phishing-resistant MFA, such as FIDO2 security keys, where feasible.
• Monitor for newly registered domains that mimic your organisation’s login portal.

Given the low cost of entry for such PhaaS platforms, it is likely this pattern will continue to evolve. Organisations relying solely on OTP-based MFA should treat these campaigns as a direct threat to their identity perimeter.

Source: Unknown

Has your team reviewed sign-in logs for unusual session behaviour, or have you already moved to phishing-resistant MFA?