Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint

Microsoft Defender Researchers uncovered a multi-stage adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) campaign targeting multiple organisations in the energy sector, which resulted in the compromise of various user accounts.

The campaign abused SharePoint file-sharing services to deliver phishing payloads and relied on inbox rule creation to maintain persistence and evade user awareness, with the attack transitioning into a series of AiTM attacks and follow-on BEC activity spanning multiple organisations.

Following the initial compromise, the attackers leveraged trusted internal identities to conduct large-scale intra-organisational and external phishing, significantly expanding the campaign’s reach, with defender detections surfacing the activity to all affected organisations.

The post-compromise steps included large-scale phishing involving more than 600 emails and subsequent BEC tactics such as monitoring undelivered emails, deleting from Archive, and replying to questions to falsely confirm legitimacy, before continuing with further AiTM activity. The report notes that password resets alone are insufficient and urges affected organisations to revoke active session cookies and attacker-created inbox rules, in addition to broader identity and endpoint protections.

According to Microsoft Defender Security Research Team, Defender XDR detects these activities and offers guidance on enabling conditional access, MFA enhancements, continuous access evaluation, and other mitigations to reduce impact.