PhishingPublished 5 May 2026

Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations

Source SecurityWeek

Description

The malicious emails claim to contain a conduct report and lure victims to a Microsoft phishing website that leverages AitM. The post Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations appeared first on SecurityWeek .

Impact

The campaign enables attackers to gain unauthorized access to Microsoft accounts by intercepting authentication tokens in real time, bypassing multifactor authentication mechanisms that are not phishing-resistant. This can lead to account compromise and potential unauthorized access to sensitive organizational resources. The attack affected a large number of organizations, primarily in the US, across critical sectors such as healthcare and financial services, increasing the risk of data breaches and operational disruption.

Defensive guidance

Microsoft has provided recommendations and threat-hunting queries to help organizations detect and mitigate this attack. Enterprises should follow Microsoft's official guidance, including user awareness training focused on phishing, monitoring for indicators of compromise, and deploying phishing-resistant multifactor authentication methods such as hardware security keys or FIDO2. Organizations should also verify email sender authenticity and be cautious with unexpected attachments and links, especially those requesting credential input.

Summary

This threat involves a phishing campaign that impersonates internal regulatory communications to trick users into visiting a malicious Microsoft phishing website. The emails contain PDF attachments with links that lead victims through CAPTCHA challenges to a phishing page where they enter their Microsoft credentials. The attackers use adversary-in-the-middle (AitM) phishing to proxy authentication sessions and capture tokens, effectively bypassing standard multifactor authentication protections. The campaign targeted over 13,000 organizations globally, predominantly in the US, and affected sectors include healthcare, financial services, professional services, and technology. The sending infrastructure used legitimate email delivery services and cloud-hosted Windows virtual machines, with attacker-controlled domains. Microsoft has issued warnings and mitigation guidance but no software patch is involved.

References

securityweek.com/microsoft-warns-of-sophisticated-phishing-campaign-targeting-us-organizations/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 May 2026, 14:51 UTC

References

Community reviews

Related threats