Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
A widespread phishing campaign is using adversary-in-the-middle techniques to hijack Microsoft 365 accounts and intercept emails related to payroll and finance, disguising its malicious sign-ins with residential proxies.
A widespread phishing campaign is using adversary-in-the-middle (AitM) techniques to hijack Microsoft 365 accounts, specifically targeting personnel involved in financial workflows to collect payroll and finance-related emails. The campaign employs residential proxies to disguise malicious sign-ins as ordinary consumer traffic, evading detection. Cybersecurity researchers warn the attack is active and email-driven.