Huntress Reports AI-Assisted Phishing Campaign Compromised Hundreds of Microsoft Cloud Accounts
Summary
Huntress says a phishing campaign using Railway infrastructure obtained Microsoft OAuth tokens valid for up to 90 days and affected hundreds of organizations. Huntress blocked Railway domains for 60,000 tenants; Railway says it banned linked accounts and domains.
Key points
- Huntress reported hundreds of affected organizations and detailed 344 victims; it said the total victim count could reach thousands.
- Researchers suspect AI was used to create individualized, non-repeating lures, including emails, QR codes, and file-sharing lures.
- The campaign abused Microsoft's device authentication flow to obtain OAuth tokens that can remain valid for up to 90 days without a password or multifactor authentication.
- Huntress said attackers used Railway infrastructure to host credential-harvesting operations and reported more than 50 Railway-linked compromises per day at one point.
- Huntress said it deployed a conditional access update blocking Railway domains for 60,000 Microsoft cloud tenants and prevented post-compromise activity for its customers.
- Railway said it banned associated accounts and blocked domains after Huntress reported phishing traffic; the company acknowledged its abuse signals did not catch the campaign quickly enough.
Article Details
- Event Type
- AI-assisted phishing campaign abusing Railway infrastructure and Microsoft’s device OAuth flow
- Impact
- Huntress reported hundreds of compromised Microsoft cloud accounts and detailed 344 victims across multiple sectors; it warned the total could be in the thousands. Attackers obtained OAuth tokens valid for up to 90 days without passwords or multifactor authentication. Huntress said it prevented post-compromise activity for its customers and issued a conditional access update affecting 60,000 Microsoft cloud tenants.
MITRE ATT&CK
People
Angelo SaracenoRailway solutions engineer who said the company responded to Huntress’s report by banning associated accounts and blocking three domains.John HultquistGoogle’s Threat Intelligence Group chief analyst cited for his assessment that AI tools may benefit smaller cybercriminal outfits more than state-sponsored hackers.Prakash RamamurthyHuntress chief product officer who commented on criminals’ early adoption of AI and the campaign’s pace.Rich MozeleskiHuntress identity team product manager who described the campaign’s scale and tactics and discussed Huntress’s conditional access policy update.
Vendors
HuntressResearchers at Huntress say a phishing campaign abusing Railway cloud-hosting infrastructure has given attackers access to hundreds of Microsoft cloud accounts.MicrosoftResearchers at Huntress say a phishing campaign abusing Railway cloud-hosting infrastructure has given attackers access to hundreds of Microsoft cloud accounts.RailwayResearchers at Huntress say a phishing campaign abusing Railway cloud-hosting infrastructure has given attackers access to hundreds of Microsoft cloud accounts.
Products
Microsoft cloudResearchers at Huntress say a phishing campaign abusing Railway cloud-hosting infrastructure has given attackers access to hundreds of Microsoft cloud accounts.RailwayResearchers at Huntress say a phishing campaign abusing Railway cloud-hosting infrastructure has given attackers access to hundreds of Microsoft cloud accounts.
Industries
ConstructionThe affected entities span a range of sectors: construction and trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were allFinance and insuranceof sectors: construction and trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were all among the 344 victims detailed inGovernmenttrade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were all among the 344 victims detailed in the Huntress blog.Healthcareand trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were all among the 344 victims detailed in the HuntressManufacturingspan a range of sectors: construction and trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were all among the 344NonprofitsThe affected entities span a range of sectors: construction and trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were allPublic safetylaw firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were all among the 344 victims detailed in the Huntress blog.real estateThe affected entities span a range of sectors: construction and trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were allTradeThe affected entities span a range of sectors: construction and trade companies, law firms, nonprofits, real estate, manufacturing, finance and insurance, healthcare, government and public safety organizations were all