Microsoft Reports Phishing Campaign Using Compliance Lures and AiTM Attacks
Summary
Microsoft observed more than 35,000 phishing attempts targeting users at roughly 13,000 organizations. The campaign uses compliance-themed PDFs and CAPTCHA pages before AiTM phishing to capture authentication tokens and access accounts.
Key points
- Microsoft observed more than 35,000 attempts from April 14 to 16, reaching users at roughly 13,000 organizations across 26 countries; 92% of targets were in the US.
- The messages impersonated internal regulatory or compliance notices and targeted sectors including healthcare, financial services, professional services, and technology.
- PDF attachments directed recipients through CAPTCHA and document-review pages before prompting them to sign in to their Microsoft accounts.
- The final step used adversary-in-the-middle phishing to proxy authentication and capture session tokens for account access.
- Microsoft said this technique can bypass multifactor authentication that is not phishing-resistant and provided mitigation recommendations, threat-hunting queries, and indicators of compromise.
Article Details
- Event Type
- Phishing campaign using a code-of-conduct review lure and adversary-in-the-middle phishing
- Impact
- Microsoft observed more than 35,000 attempts between April 14 and 16, with messages reaching users across roughly 13,000 organizations in 26 countries; 92% of targets were in the United States. The campaign sought to capture authentication tokens and gain immediate access to targeted accounts, and could bypass non-phishing-resistant multifactor authentication. Targeted sectors included healthcare and life sciences, financial services, professional services, and technology and software.
MITRE ATT&CK
Vendors
CloudflareWhen the link is clicked, the user is taken to a Cloudflare CAPTCHA page, which Microsoft believes serves as a gating mechanism against automated analysis. The victim is then directed to a page stating that theMicrosoftMicrosoft has warned organizations in the United States about a sophisticated phishing campaign that uses a “code of conduct review” theme to lure victims to a malicious website.
Products
Cloudflare CAPTCHAWhen the link is clicked, the user is taken to a Cloudflare CAPTCHA page, which Microsoft believes serves as a gating mechanism against automated analysis. The victim is then directed to a page stating that theMicrosoft accountThe user is then told that the verification has been successfully completed and is asked to sign in to their Microsoft account.
Countries
Industries
Financial ServicesMany of the messages were received by users in the healthcare and life sciences, financial services, professional services, and technology and software sectors.healthcare and life sciencesMany of the messages were received by users in the healthcare and life sciences, financial services, professional services, and technology and software sectors.Professional ServicesMany of the messages were received by users in the healthcare and life sciences, financial services, professional services, and technology and software sectors.technology and softwareMany of the messages were received by users in the healthcare and life sciences, financial services, professional services, and technology and software sectors.