{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/aitm/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Microsoft Defender for Office 365"],"_cs_severities":["high"],"_cs_tags":["phishing","credential-theft","AiTM","token-compromise"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Cloudflare","Paubox"],"content_html":"\u003cp\u003eBetween April 14 and 16, 2026, Microsoft Defender Research observed a sophisticated, large-scale phishing campaign targeting over 35,000 users across more than 13,000 organizations in 26 countries, predominantly in the United States (92%). The campaign, which did not focus on a single vertical, impacted a range of industries, with Healthcare \u0026amp; life sciences (19%), Financial services (18%), Professional services (11%), and Technology \u0026amp; software (11%) being the most affected. Attackers employed code of conduct-themed lures delivered via emails that appeared as internal compliance or regulatory communications. The campaign utilized a multi-step attack chain, including CAPTCHA challenges and intermediate staging pages, to reinforce legitimacy and filter out automated defenses, ultimately leading to an adversary-in-the-middle (AiTM) phishing flow.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attack begins with phishing emails posing as internal compliance communications, using subjects like \u0026ldquo;Internal case log issued under conduct policy\u0026rdquo;.\u003c/li\u003e\n\u003cli\u003eThe emails contain a PDF attachment (e.g., \u0026ldquo;Awareness Case Log File – Tuesday 14th, April 2026.pdf\u0026rdquo;) that claims a \u0026ldquo;code of conduct review\u0026rdquo; has been initiated.\u003c/li\u003e\n\u003cli\u003eRecipients are instructed to click a “Review Case Materials” link within the PDF.\u003c/li\u003e\n\u003cli\u003eClicking the link redirects the user to one of the attacker-controlled domains (e.g., acceptable-use-policy-calendly[.]de).\u003c/li\u003e\n\u003cli\u003eThe landing page displays a Cloudflare CAPTCHA to validate the user and impede automated analysis.\u003c/li\u003e\n\u003cli\u003eAfter CAPTCHA completion, the user is redirected to an intermediate site that informs them the requested documentation is encrypted and requires account authentication.\u003c/li\u003e\n\u003cli\u003eThe user is presented with a legitimate-looking sign-in experience, part of an AiTM phishing flow.\u003c/li\u003e\n\u003cli\u003eThe attackers proxy the authentication session in real time and capture authentication tokens, granting immediate account access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis campaign resulted in the compromise of authentication tokens, enabling attackers to gain unauthorized access to user accounts and bypass multifactor authentication. With more than 35,000 users targeted across over 13,000 organizations, the potential for widespread data breaches, financial fraud, and further malicious activities is significant. The targeting of sectors like Healthcare and Financial Services indicates a focus on high-value targets with sensitive data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEducate users about phishing lures, especially those using social engineering tactics and enterprise-style HTML templates.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Suspicious PDF Opening via Uncommon Applications\u0026rdquo; to identify unusual PDF execution paths, based on the \u0026lsquo;file_event\u0026rsquo; log source.\u003c/li\u003e\n\u003cli\u003eConfigure email security settings in Microsoft Defender for Office 365 to filter out phishing emails effectively.\u003c/li\u003e\n\u003cli\u003eEnable network protection to leverage SmartScreen as a host-based web proxy.\u003c/li\u003e\n\u003cli\u003eBlock access to the attacker-controlled domains, such as acceptable-use-policy-calendly[.]de, at the DNS resolver level.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-04T15:00:00Z","date_published":"2026-05-04T15:00:00Z","id":"/briefs/2026-05-aitm-phishing/","summary":"A widespread phishing campaign utilized 'code of conduct' lures, a multi-step attack chain, and legitimate email services to distribute authenticated messages from attacker-controlled domains, ultimately leading to adversary-in-the-middle (AiTM) token compromise, primarily targeting US-based organizations.","title":"Multi-Stage 'Code of Conduct' Phishing Campaign Leads to AiTM Token Compromise","url":"https://feed.craftedsignal.io/briefs/2026-05-aitm-phishing/"}],"language":"en","title":"CraftedSignal Threat Feed — AiTM","version":"https://jsonfeed.org/version/1.1"}