Adversary-in-the-Middle Phishing Campaign Targets Microsoft 365 and Okta Users

Du'aine Davis

Observed in the wild

• A phishing campaign active since early December 2025 is targeting organisations using Microsoft 365 and Okta SSO. Hundreds of users across multiple companies received emails themed around year-end compensation reviews. The campaign hijacks legitimate authentication flows, enabling attackers to steal credentials and session tokens, even bypassing non-phishing-resistant MFA.
• Attackers use adversary-in-the-middle techniques, proxying traffic through lookalike domains (e.g., sso.okta-secure[.]io) and injecting malicious JavaScript to capture usernames, passwords, and session cookies. Initial access is via phishing emails or PDFs with links hidden behind shorteners, hosted on Cloudflare infrastructure. The campaign also exploits Okta federation redirects to compromise Microsoft 365 accounts.
• Organisations should monitor Okta and Microsoft 365 logs for anomalies, such as mismatched origins or suspicious Cloudflare domains. Enable Okta FastPass for phishing-resistant MFA and review events like user.authentication.auth_via_mfa and policy.evaluate_sign_on. In Microsoft 365, search for phishing email subjects and apply detection rules for inbox forwarding and risky user behaviour. Use Microsoft Defender to flag anomalous sign-ins and enforce conditional access policies.

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users | Datadog Security Labs