AitM Phishing Targets Financial Data

A widespread email-driven campaign is currently leveraging adversary-in-the-middle (AitM) techniques to gain unauthorized access to Microsoft 365 environments. By masquerading as legitimate traffic, the attackers are successfully infiltrating organizations to conduct reconnaissance on financial workflows and harvest sensitive corporate communications.

The threat actors are specifically targeting personnel involved in payroll, HR, and finance departments. By maintaining persistent access to these accounts, the campaign aims to monitor internal documents, invoices, and payment-related correspondence without immediately alerting security teams.

Disguising Malicious Traffic

To evade traditional security filters, the operators utilize residential proxies to ensure their malicious sign-in attempts mirror ordinary consumer behavior. This infrastructure allows the attackers to bypass geolocation-based access controls by matching the source IP address to the victim's country.

The activity is highly automated, with stolen sessions refreshed at consistent intervals. Arctic Wolf Labs reported that this technical approach enables the maintenance of access for extended periods while minimizing the footprint left on the compromised account.

The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic. Automated activity maintains compromised sessions at approximately eight-hour intervals.

— Arctic Wolf Labs, cybersecurity research organization

Multi-Stage Redirection Chains

The attack sequence begins with phishing emails themed around voicemails, which direct targets to hijacking infrastructure. These pages act as proxies for the legitimate Microsoft authentication flow, capturing both primary credentials and multi-factor authentication (MFA) codes in real-time.

To bypass reputation-based filtering, the attackers employ a six-stage redirection chain. This process leverages trusted services including Google, Google Meet, Google Ads, and Amazon S3 to obfuscate the final destination of the malicious links. Once a user clicks the initial link, the chain routes them through various platforms before landing on an HTML object hosted within an Amazon AWS S3 bucket, which ultimately leads to the AitM phishing portal.

Host Fingerprinting and Reconnaissance

Before the victim reaches the authentication page, the phishing site deploys JavaScript designed to harvest extensive host telemetry. This data collection includes:

• Web browser version and API availability
• Operating system details
• Screen and window dimensions
• Time zone offset and language settings
• WebDriver status and cookie capabilities

This information is transmitted to a PHP endpoint, providing the attackers with a detailed profile of the victim's device. Furthermore, the infrastructure queries a geolocation API to store the user's country code, enabling the subsequent use of geographically matched residential proxies for session persistence.

Stealthy Post-Compromise Tactics

Once initial access is secured, the attackers focus on long-term data collection rather than immediate disruption. In the majority of cases, they avoid high-visibility actions like creating inbox rules or modifying MFA methods, which are common triggers for security alerts. Instead, they rely on the account takeover to quietly enumerate tenant users and extract emails related to banking, benefits, and payroll.

The threat cluster displays tactical overlaps with Storm-2755, a group previously identified for rerouting salary payments. While much of the activity is automated, there is evidence of selective manual intervention, where operators create specific inbox rules to move messages to deleted items, effectively masking their presence from the victim.

Implications for Enterprise Security

This campaign underscores the limitations of relying solely on standard MFA to protect cloud environments. By intercepting authentication tokens through AitM proxies, attackers can circumvent traditional two-factor protections, regardless of the user's password strength. The restrained nature of the post-compromise activity makes these breaches particularly difficult to detect, as the attackers are not triggering alarms through obvious credential modification or outbound spam. For organizations, the reliance on automated session maintenance and rotating proxy infrastructure suggests that defending against such threats requires a transition toward session-aware security policies and rigorous monitoring of anomalous sign-in patterns, even when those sessions originate from seemingly legitimate geographic sources.