Microsoft has issued a warning about a highly coordinated, multi-stage adversary-in-the-middle (AitM) phishing campaign that has escalated into business email compromise (BEC) attacks across multiple organizations in the energy sector.
According to the Microsoft Defender Security Research Team, the campaign abuses SharePoint file-sharing services to deliver phishing payloads and relies on malicious inbox rules to stay hidden after initial access. What begins as a phishing email quickly evolves into a broader operation that spreads laterally, both within and outside affected organizations.
How the Attack Begins
The entry point is a phishing email sent from an address that already belongs to a trusted organization. These accounts were compromised earlier and then reused to lend credibility to the next wave of attacks.
Malicious individuals mimic the notifications sent to SharePoint document sharing users to trick them into accessing a file via a hyperlink. Since both SharePoint and OneDrive are utilized extensively throughout many enterprises to manage e-mail communications, along with having e-mails sent from authentic e-mail addresses, individuals tend to not question these kinds of messages or utilize automatic filter systems to catch these phishing attempts.
This is an example of living-off-trusted-sites (LOTS) -- leverage existing website platforms with large user bases to leverage their trust to evade existing e-mail security measures.
Credential Theft/Persistence
If someone clicks on a link, they will be forwarded to a fraudulent login page where they are asked to input the user’s credentials and provide them to the attacker, as well as to provide active session cookies for that user’s account. Once the successful logging into the user account takes place, the attacker can then create persistence by establishing new rules in the user mailbox to delete all incoming e-mails and/or to mark all of the e-mails that are not read.
Additionally, the criminals can delete any out-of-office responses a user may have set up in their account configuration and/or eliminate any correspondence alerting the victim to this type of activity so these activities can go unnoticed. This allows criminals to remain in a compromised mailbox undetected.
Scaling the Campaign
Once they gain access to a victim's inbox, attackers will typically launch mass phishing attacks leveraging the victim's identity. An example of this was when Microsoft reported over 600 phishing emails that were sent to both internal and external contacts after an organization’s inbox was compromised.
When recipients of these phishing emails question whether the emails are legitimate or not, attackers will engage with the recipient and respond to their concern, only to delete the conversation after replying in order to cover their tracks.
Again, these types of activities align with established Business Email Compromise (BEC) tactics to keep victims oblivious to the true nature of the attackers while being able to provide continuous access.
Why Password Resets Are NOT Enough
Microsoft further stated that just resetting a password will not prevent Access in the Middle (AitM) attacks. Since an attacker is stealing session cookies in real time, the attacker will still have access, even if the credentials to access the account have changed.
To truly remediate an impacted account, organizations must:
1. Revoke Active Session Tokens
2. Remove any inbox rules that are created by the attacker
3. Reverse any MFA changes that were made by the attacker.
Microsoft has stated that they worked directly with customers who were affected to implement the above-mentioned actions.
Trends - Trust As A New Weapon
This campaign is indicative of the growing trend of attackers who are leveraging trusted sites, such as:
1. SharePoint
2. Google Drive
3. AWS
4. Atlassian Confluence
Additional Reports of Phishing
In addition, Okta, an identity provider, released its findings on a number of customised phishing kits created to assist a group of criminal hackers with conducting voice phishing operations through telephone-based technology support staff impersonations and live-interactive credential theft from victims. The technology will permit the criminals to monitor the authentication process remotely while the victim is following the criminal's instructions via telephone, which presents an opportunity for Multi-Factor Authentication bypass for victims, unless they are using phishing-resistant Multi-Factor Authentication.
In addition, other recent voice phishing campaigns have been conducted by the criminals using:
1. The Abuse of Basic Authentication URLs (username:password@domain)
2. Attacks based on the Similar Sound of the Homoglyph; such as using "rn" in the place of "m," (example - rnicrosoft[.]com)
The criminals take advantage of the fact that when scanning through a URL quickly, it is easier for victims to mistake the letter "m" for a variation of "rn".
What Organizations Should Do
Microsoft recommends organizations:
1. Deploy phishing-resistant MFA
2. Enforce conditional access policies
3. Enable continuous access evaluation
4. Monitor inbox rule creation
5. Use advanced anti-phishing solutions that scan emails and visited links
As attackers continue to exploit trust rather than technical flaws, identity security has become the primary battleground.
Source: The Hacker News
