Cyber Security - AiTM Phishing and Business Email Compromise

2 days ago

Author

Tim Mansell

My email was compromised and the attackers sent malicious links to all my customer and suppliers - sound familiar? Hopefully not.

Multi-Stage AiTM Phishing & BEC Attacks Targeting Enterprise Email

Source: The Hacker News

TLDR (too long; didn't read): Step 1: You receive an email from a well-known contact, Step 2: the email includes a link to a PDF/Word document, Step 3: the document asks you to authenticate with your company email, Step 4: your credentials are stolen, Step 5: your account is compromised, Step 6: the attacker sends over 3000 emails to all of your contacts, customers, and suppliers with a phishing link. Your company data/network/security is compromised. Go to Step 1.

We’re highlighting the importance of Cyber Security and User Awareness for one of the most (currently) common threats. This is not a new threat, we've seen this setup for a long time, we're raising awareness as the threat campaign is particularly active right now and you, your employees, colleagues, customers and suppliers all need to make an effort to stop and think.

When it comes to IT, running a business requires multiple lines of defense; documented policies and procedures, cloud and device-based security software, and user awareness training, even so the attackers are working full time using advanced techniques and multi-stage campaigns to find a way into your business.

Microsoft has recently raised the alarm on a sophisticated multi-stage phishing campaign leveraging Adversary-in-the-Middle (AiTM) techniques combined with Business Email Compromise (BEC). They mention the Energy Sector being targeted, but at Redloft we see and stop this type of sophisticated attack regularly for customers just like you.

This isn’t your typical phishing scam, it’s a multi-phase, highly stealthy threat that abuses trusted services to evade detection and maintain long-term access.

What is an AiTM attack?

An Adversary-in-the-Middle (AiTM) attack sits directly between a user and a legitimate login flow. Unlike standard phishing which simply tricks a user into entering credentials. AiTM actively captures credentials, multifactor authentication (MFA) responses, and session cookies in real time. These stolen tokens often let the attacker bypass MFA and impersonate the user without ever triggering alerts in traditional systems. (Microsoft)

This type of attack has been escalating in recent years, targeting Microsoft 365, Okta, Google Workspace, and other identity platforms. (The Hacker News)

How do they get in?

1. Initial Compromise via Trusted Sender

Threat actors begin by sending phishing emails from a legitimate but compromised account, often mimicking SharePoint or file-sharing communications. These messages are far more likely to bypass email filters because they originate from trusted infrastructure. (The Hacker News)

2. Phishing Link Hits Fake Login Page

Recipients who click the link are redirected to a convincing credential prompt. Behind the scenes, the AiTM infrastructure captures not just the password, but also MFA tokens and session cookies. (Microsoft)

3. Inbox Rule Creation

Once inside, attackers create malicious inbox rules that delete incoming mail or mark it as read, effectively hiding their activity and disabling notifications that might alert the victim or security teams. (The Hacker News)

4. Mass Strategic BEC

With access locked in, the attackers send a large volume of further phishing emails, often targeting internal contacts and external partners, continuing the cycle of compromise. (Microsoft)

This blend of AiTM and BEC isn’t just sophisticated, it’s remarkably resilient. Simply resetting a password often is not enough because session cookies and MFA manipulations still grant ongoing access. (The Hacker News)

Flow of attack (Courtesy of Microsoft):

Why does this matter to you?

Trying not the mention the most recent high-profile attack on a UK car manufacturer, but this can affect everyone in the supply-chain, employees, employers, customers, suppliers - people lose jobs, their businesses and ultimately it can impact all of us. We are all responsible.

This is a real threat, automated, and weaponising customer trust in major cloud services. Attackers are increasingly depending on living-off-trusted-sites (LOTS) tactics, using legitimate cloud platforms like SharePoint, OneDrive, AWS, and Google Drive to host phishing content that slips past detection filters. (The Hacker News)

Goal of their campaign:

Bypass MFA protections.
Stealthily hijack accounts.
Expand compromise laterally across organisations.

How to defend against these attacks?

To protect your business and its identity infrastructure, consider the following best practices:

Harden Identity Security

Phishing-resistant MFA - Prefer protocols like FIDO2 or certificate-based authentication, compliant and managed devices with Microsoft 365. (Microsoft)
Conditional Access Policies - Enforce access controls based on user risk, location, or device status. (Microsoft)

Monitor Anomalies

Inspect mailbox rules - Alerts for new or suspicious rules can reveal hidden compromise. (Microsoft)
Correlate login behaviours - Watch for impossible travel, unfamiliar IP addresses, and session token reuse.

Leverage Advanced Detection

Platforms like Microsoft Defender XDR can automatically detect and disrupt AiTM attack flows, including disabling compromised accounts and revoking stolen session cookies, actions that go beyond simple password resets. (TECHCOMMUNITY.MICROSOFT.COM)

What should you do next?

Organisations must evolve their defensive strategy beyond classic email filtering and password policies. With threat actors increasingly blurring the line between legitimate services and malicious intent, protecting identities and access pathways has become the front line of cybersecurity.

At Redloft Technology, we help businesses assess identity risk, implement strong MFA and conditional access controls, and align security operations to detect and respond to advanced threats like AiTM phishing and BEC.