From the Desk of the CISO: Why Your M365 Password and MFA Are Not Enough

What is Happening Right Now

An active, widespread email-driven phishing campaign is employing adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts, with the specific aim of identifying key personnel involved in financial workflows and gathering sensitive email data. This is not a theoretical threat. It is happening right now, at scale, across industries including healthcare, manufacturing, government, and professional services.

There is also a data extortion group known as UNC6671 that has been conducting voice phishing, or "vishing", attacks against enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. These calls are designed to trick victims into visiting spoofed login portals where AitM infrastructure intercepts their credentials and multi-factor authentication (MFA) tokens in real time.

Taken together, these campaigns represent a fundamental shift in how attackers are targeting organizations and why every business leader and employee needs to understand it.

What is an Adversary-in-the-Middle (AitM) Attack?

Most people have heard of phishing. You click a bad link, enter your password on a fake website, and attackers steal it. AitM attacks are different and far more dangerous.

In an AitM phishing attack, an attacker positions a server between the victim and a legitimate login page. This proxy relays the victim's credentials to the real service in real time, completes the authentication flow – which includes any MFA challenge – and captures the resulting session cookie or token. The attacker then replays that token to access the victim's account without needing the password or MFA device again.

In plain language: the attacker is not stealing your password. They are stealing proof that you already successfully logged in.

Unlike traditional credential phishing, AitM attacks steal the authenticated session itself. This is what makes them effective against time-based one-time password (TOTP), push-based MFA, and SMS codes.

This means that while still critically important, turning on MFA is no longer sufficient protection on its own against this class of attack.

How These Attacks Are Carried Out

Here is what a typical AitM attack looks like in practice:

1. Attack chains involve the use of voicemail-themed phishing emails that lead victims to AitM decoy pages acting as a proxy for the legitimate Microsoft account authentication flow, while stealthily capturing credentials and MFA codes.

2. A six-stage redirection chain is used, employing legitimate and trusted services like Google Meet, Google Ads, and Amazon S3 to sidestep reputation-driven security filters.
3. The phishing pages fingerprint the visiting device, gathering information about the web browser, operating system, screen dimensions, browser language, and time zone to craft a convincing, targeted experience.

In the vishing variant used by threat group UNC6671, the attack begins with a phone call:

1. Callers contact targeted employees on their personal cell phones, posing as internal IT or help desk personnel, citing a mandatory migration to passkeys or a required MFA update.

2. The victim is directed to a lookalike subdomain mirroring the organization's single sign-on (SSO) portal.
   
3. As the victim inputs their username and password, the threat actor captures these in real time and immediately submits them to the legitimate SSO provider.
4. When the legitimate portal issues an MFA challenge, the victim – believing they are completing a required setup step – provides the code or approval directly to the attacker.

Once inside, the attackers move fast. Upon establishing persistence, attackers transition from interactive browser-based reconnaissance to automated exfiltration, using scripts to harvest high-value data from email, SharePoint, and OneDrive repositories.

There is also a third dimension to this threat. Researchers have demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longer-term cloud access, register a device they control, obtain a Primary Refresh Token (PRT), and add further authentication methods. Administrator privileges are not required to carry this out.

Why This Attack is Becoming So Common

There are several reasons AitM phishing has exploded in adoption among cybercriminals. First, the tools are widely available. Proxy-based attacks are frequently packaged as turnkey phishing kits, making AitM capabilities accessible to operators with minimal technical skills. A threat actor does not need to be technically sophisticated to launch one of these campaigns.

Second, businesses have gotten better at traditional defenses. Phishing campaigns continue to improve in sophistication, blending social engineering, delivery infrastructure, and authentication abuse to remain effective against evolving security controls. As organizations have adopted MFA more broadly, attackers have adapted by targeting what comes after a successful login – the session token – rather than the login itself.

Third, the financial incentive is enormous. As reported by The Hacker News, between January 7 and May 12, 2026, over $10.6 million in Bitcoin payments were tracked to wallets associated with UNC6671 alone. Initial ransom demands reach north of $3 million, and in more than 53% of tracked cases, threat actors settled for an average of $750,000.

The combination of low barriers to entry and high financial reward has made this one of the fastest-growing attack techniques in the cybersecurity landscape.

What Our Security Tech Stack Is Doing to Stay Ahead

Protecting our clients against AitM attacks requires multiple layers of defense working together. Here's what we have in place:

• Managed Detection and Response (MDR) provides 24x7 security monitoring and threat detection. Our MDR platform has been actively tracking this campaign including the use of residential proxies, rotating IP addresses, and recurring compromised sessions – and issuing detailed threat intelligence to detect these specific attack behaviors.
• Endpoint Detection and Response (EDR) provides endpoint-level threat detection and response, identifying malicious activity and suspicious sign-in behaviors that would indicate a compromised session being used on managed devices.
• Identity and Access Management (IAM) with Conditional Access enforces device compliance checks and location-based policies. Detection signals such as impossible travel, device compliance mismatches, and token anomalies – including sessions with abnormal lifetimes, unusual user-agent strings, or tokens replayed from known proxy infrastructure – can surface many of these threats when conditional access policies enforce device compliance and location checks.
• Cloud Email Security with advanced link and attachment inspection provides email-level scanning before messages reach end users.
• Security Information and Event Management (SIEM) provides continuous log monitoring, allowing our team to hunt for anomalous user-agent strings, unusual file access patterns, and non-standard authentication events consistent with AitM intrusions.
• Next-Generation Firewalls (NGFW) and Network Security provide perimeter-level filtering and traffic inspection, adding a network-layer barrier against known malicious proxy infrastructure.

Together, these tools help our team detect and respond to AitM activity that gets past a user's initial login – the point at which most organizations have no visibility at all.

What You Need to Be Telling Your Employees

Technology controls are essential, but your employees remain the most important line of defense against this type of attack. Here is what your team needs to know:

Spot the signs of a vishing attack:

• Attackers contact employees via their personal mobile phones, posing as IT help desk staff claiming a mandatory, urgent security migration is underway. Any unsolicited call from "IT" directing you to log into a link or portal should be treated as suspicious.
• The calls create urgency before employees can verify the request independently. Slow down. Verify. Do not act under artificial pressure.
• Always verify unexpected IT requests through a known, internal, company channel and not the phone number or link the caller provides.

Watch the URL, always:

• The only visible clue during an AitM attack is the attacker's hostname in the address bar rather than the real one. Train employees to check the URL before entering any credentials. If the domain looks even slightly unusual, stop and report it.
• Attackers register domains that combine words like "passkey," "MFA," or "SSO" to reinforce the false impression that a routine security task is underway. These are red flags.

Understand that MFA is not infallible:

• Employees should know that MFA prompts they did not initiate are a warning sign. If you receive an MFA push or code request that you did not trigger yourself, reject it and report it immediately to your IT team.
• Attackers establish persistence by registering adversary-controlled MFA devices to compromised accounts, but not before removing existing MFA devices. If an employee ever loses access to their MFA method unexpectedly, this should be treated as a security incident and not a technical glitch.

Reporting is the most important action:

• Create a culture where employees feel comfortable reporting suspicious calls, emails, and login prompts immediately and without fear of embarrassment. The faster a potential AitM incident is reported, the faster we can act to contain it.

A Final Word

The threat of AitM phishing and token theft is real, it is active, and it is specifically targeting the tools your business runs on every day – including Microsoft 365. The good news is that with the right combination of technology, process, and user awareness, these attacks can be detected and stopped.

Our team is monitoring for these threats around the clock on your behalf. But your employees are a critical part of this defense. Invest in their awareness. Teach them to slow down, verify, and report. It may be the single most impactful action your organization takes this year.

If you have questions about how we protect environments, or would like to discuss implementing phishing-resistant MFA or security awareness training for your team, please reach out! We are here to help.

- Kent Goodrow, Chief Information Security Officer

kgoodrow@systemsengineering.com