Microsoft 365 Phishing Campaign Targets Payroll, Finance Emails

Cybersecurity researchers have identified an active and widespread phishing campaign that leverages adversary-in-the-middle (AitM) techniques to compromise Microsoft 365 accounts. The primary objective of this campaign is to gain access to sensitive information, specifically targeting key personnel involved in financial workflows and collecting related email communications. This sophisticated attack method aims to steal payroll and finance-related emails, providing attackers with valuable data for further exploitation or financial gain. The campaign utilizes residential proxies to mask malicious sign-ins, making them appear as legitimate consumer traffic. This obfuscation technique is designed to evade detection by standard security measures that monitor for unusual login patterns or IP addresses. By routing traffic through these proxies, the attackers can blend in with normal user activity, increasing the likelihood of a successful compromise. The threat actors are specifically looking to identify individuals responsible for financial operations within organizations, such as those in payroll, accounts payable, and finance departments. Once access is gained to these accounts, the attackers can exfiltrate emails containing sensitive financial data, including salary information, bank details, invoices, and payment instructions. This information can then be used for various malicious purposes, including direct financial fraud, business email compromise (BEC) attacks, or to facilitate further social engineering efforts against the targeted organization. The researchers have not yet attributed the campaign to a specific threat actor group, but its widespread nature and technical sophistication suggest a well-resourced and organized operation. The use of AitM phishing is a growing concern in the cybersecurity landscape, as it bypasses traditional multi-factor authentication (MFA) methods that rely on session cookies. In AitM attacks, the attacker intercepts the authentication process between the user and the legitimate service, allowing them to capture session tokens and gain unauthorized access without needing the user's password or MFA code. This makes the attack particularly insidious and difficult to defend against. Organizations using Microsoft 365 are advised to enhance their security posture by implementing advanced threat protection solutions, conducting regular security awareness training for employees, and closely monitoring their Microsoft 365 environments for suspicious activity. The campaign's focus on financial data highlights the critical need for robust security measures to protect sensitive corporate information from increasingly sophisticated cyber threats.