This threat involves a multi-stage adversary-in-the-middle (AiTM) phishing campaign that uses code of conduct-themed emails to deceive users into submitting credentials. The attackers leveraged legitimate email delivery services and attacker-controlled domains to send convincing phishing emails with PDF attachments and CAPTCHA challenges to avoid automated detection. The final stage redirects victims to fake Microsoft authentication pages that intercept credentials and session tokens in real time, effectively bypassing multi-factor authentication protections. The campaign primarily affected U.S.-based healthcare and financial organizations and targeted over 35,000 users across 13,000 organizations.

The campaign enables attackers to steal user credentials and session tokens in real time, bypassing multi-factor authentication defenses. This can lead to unauthorized access to sensitive accounts and data, particularly impacting healthcare and financial sectors in the United States. The use of CAPTCHA gates and polished phishing content increases the likelihood of successful credential theft by evading automated detection systems.

No official patch or fix is applicable as this is a phishing campaign rather than a software vulnerability. Organizations should educate users to recognize phishing emails, especially those masquerading as internal compliance communications. Blocking or monitoring the identified attacker-controlled domains (acceptable-use-policy-calendly.de, cocinternal.com, compliance-protectionoutlook.de) can help reduce exposure. Implementing advanced email filtering and multi-factor authentication methods resistant to AiTM attacks may also reduce risk. Since no vendor advisory or patch is available, continuous vigilance and user awareness are critical.