Microsoft Warns of Sophisticated AitM Phishing Campaign Targeting US Organizations

Microsoft has issued a warning regarding a sophisticated phishing campaign actively targeting organizations in the United States. According to SecurityWeek, the attack vector involves malicious emails designed to appear as conduct reports, luring unsuspecting victims to a meticulously crafted Microsoft phishing website. This isn’t just a simple credential grab; the campaign leverages Adversary-in-the-Middle (AitM) techniques, significantly escalating its danger.

AitM attacks are a game-changer for attackers because they bypass traditional multi-factor authentication (MFA) mechanisms. By acting as a proxy between the user and the legitimate service, the attackers can intercept and replay session cookies, effectively authenticating as the user without needing their password or MFA token. This makes the phishing site far more convincing and the resulting compromise much deeper, granting persistent access.

For defenders, this means relying solely on user vigilance against phishing links is insufficient. The attacker’s calculus here is clear: target high-value US organizations with a technique that circumvents a critical layer of modern security. The focus on ‘conduct reports’ suggests a social engineering angle designed to induce immediate action and fear, further increasing the likelihood of compromise.