Widespread Microsoft 365 Phishing Campaign Targets Payroll and Finance Emails

Cybersecurity researchers have identified an ongoing phishing campaign targeting Microsoft 365 accounts across various industries in the US, Canada, and Europe. The attackers employ adversary-in-the-middle (AitM) techniques to gain access to compromised sessions, which are then used to collect payroll and finance emails.

The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic. Once initial access is obtained, the threat actors abuse the compromised sessions to collect emails from personnel involved in financial matters at the enterprise.

Arctic Wolf researchers observed hundreds of organizations being targeted by email as part of the latest phishing campaign last month, resulting in successful intrusions spanning a broad range of victim environments.