Multi‑stage AiTM phishing and BEC leverages SharePoint to breach energy firms

Du'aine Davis

Observed in the wild

• In January, Microsoft observed a multi‑stage adversary‑in‑the‑middle (AiTM) phishing and business email compromise (BEC) campaign targeting multiple organisations, primarily in the energy sector. Several user accounts were compromised, with attackers later expanding activity internally and externally by abusing trusted identities to scale phishing operations across organisations.
• An unknown threat actor used emails from a previously compromised trusted organisation, impersonating SharePoint document‑sharing workflows. Victims were redirected to credential‑harvesting pages enabling session cookie theft. Attackers created malicious inbox rules to hide activity, replayed stolen sessions, and launched large‑scale follow‑on phishing and BEC activity from compromised mailboxes.
• Microsoft advises revoking session cookies in addition to password resets, removing attacker‑created inbox rules, and reversing unauthorised MFA changes. Use Microsoft Defender XDR, Defender for Office 365, and Entra ID Protection to detect malicious rules, suspicious sign‑ins, and AiTM indicators. Enforce conditional access, phishing‑resistant MFA, continuous access evaluation, and monitor anomalous mailbox and sign‑in behaviour.

Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint  | Microsoft Security Blog