Researchers have documented a global phishing operation that uses fake procurement emails and hijacked login sessions to break into Microsoft 365 accounts, even when multi-factor authentication is switched on.

 

What happened

A phishing campaign first observed in May 2026 has been targeting universities, enterprises, and multinational institutions, including agencies connected to the European Union and the United Nations, according to CyberSecurityNews. The operation began with a single phishing email sent to a small group of employees, then spread as attackers took over compromised Outlook mailboxes and used them to resend the same procurement-themed lures to colleagues and external partners. Because the messages arrived from real accounts belonging to trusted contacts, they carried none of the usual warning signs. Victims who clicked were led through fake document portals, CAPTCHA checks (the puzzle-style tests websites use to prove a visitor is human), and cloned Microsoft 365 login pages impersonating brands such as Microsoft, OpenGov, ConstructConnect, and the European Investment Bank.

 

Going deeper

The technique behind the campaign is called adversary-in-the-middle phishing, where the attacker's server sits invisibly between the victim and the genuine login page, relaying traffic in both directions while copying everything that passes through. When the victim completes a real sign-in, including approving an MFA prompt, the attacker captures the session cookie and authentication token, the small pieces of data a browser holds to prove a user has already logged in. Reusing those tokens lets the attacker open a fully authenticated session without ever needing the password or the MFA code again, granting access to Outlook mailboxes, SharePoint files, and other Microsoft 365 resources. Researchers attribute the activity to a single actor who rotates among several phishing-as-a-service kits, meaning ready-made phishing toolsets rented out to criminals, including EvilProxy, FlowerStorm, and Kali365. Rather than registering fresh domains that security filters would flag as suspicious, the actor injects malicious PHP files into aged, often dormant websites that appear to have been compromised, turning legitimate small-business infrastructure into cover for near-identical fake download pages.

 

What was said

"These actors are using trust in organisational processes, like purchases, to convince people to hand over their credentials," said Dr. Renée Burton, vice president of the threat intelligence group that documented the campaign, in comments published alongside the research on July 22, 2026. "It's not a phishing scenario that you are usually warned about in security training."

 

In the know

Kali365, one of the kits this actor cycles through, already carries an FBI warning. The bureau's Internet Crime Complaint Center flagged the platform on May 21, 2026, noting it appeared that April and sells through Telegram. Its method is not the relay technique behind the procurement lures but device code abuse, where the victim types a short code into Microsoft's own genuine login page and unknowingly authorizes the attacker's application. The FBI recommends a conditional access policy blocking device code flow, with exceptions only for teams that need it.

 

The big picture

Standard multi-factor authentication was designed to stop stolen passwords, not stolen sessions, and campaigns like this one exploit that gap. The Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to adopt phishing-resistant MFA, such as hardware security keys built on the FIDO2 standard, because one-time codes and push approvals can be intercepted or relayed by an attacker sitting in the middle of a login. Healthcare organizations have particular reasons to pay attention. According to Paubox's report on the top three healthcare email attacks, phishing-driven mailbox takeovers exposed more than 630,000 individuals in 2025, making credential compromise the most damaging email attack type by impact, and one of the recurring defensive failures was treating MFA as a backstop rather than a preventive control. Once an attacker holds a valid session, downstream security tools see a legitimate user, which is why stopping the phishing email before anyone clicks remains the point of leverage that decides whether these attacks succeed.

 

FAQs

What makes phishing-resistant MFA different from a one-time code or push notification?

Phishing-resistant methods like FIDO2 security keys and passkeys bind the login cryptographically to the genuine website's address, so the authentication simply fails on a lookalike page. A one-time code has no such binding, which is why an attacker relaying a real login page can capture and reuse it instantly.

 

If session tokens are stolen, does resetting the password fix the problem?

No. A password reset does not automatically invalidate active sessions, so administrators also need to revoke the user's sign-in sessions and refresh tokens through the identity platform's admin controls. Skipping that step can leave the attacker logged in after the password changes.

 

Are there sign-in policies that limit the damage from a stolen token?

Yes. Conditional access rules can restrict logins to managed devices, known locations, or compliant browsers, and shorter token lifetimes reduce how long a stolen session stays useful. Microsoft also offers token protection features that tie certain tokens to the device that requested them.

 

Would a mailbox takeover at a healthcare organization count as a HIPAA breach?

Usually, yes. If protected health information sits in the compromised mailbox, the Department of Health and Human Services treats unauthorized access as a reportable breach, triggering notification duties to affected patients, regulators, and in larger incidents the media, generally within 60 days of discovery.

 

How can defenders spot adversary-in-the-middle infrastructure before users click?

DNS-layer monitoring helps because phishing kits leave recognizable fingerprints in subdomain naming conventions, hosting patterns, and certificate registrations. Blocking newly observed or suspicious domains at the DNS resolver stops the connection before the fake page ever loads, regardless of how convincing the email looked.