Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Cybersecurity researchers have identified a large-scale phishing campaign that uses adversary-in-the-middle techniques to hijack Microsoft 365 accounts. The goal of the campaign is to identify key personnel involved in financial workflows and collect related emails, particularly those related to payroll and finance. The campaign disguises malicious sign-ins as ordinary consumer traffic by using residential proxies.