Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. "The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,

The report describes an active email-driven adversary-in-the-middle phishing campaign that targets Microsoft 365 accounts, captures credentials and MFA codes, and focuses on users involved in payroll and finance workflows. It also says the attackers use trusted services and residential proxies to make malicious sign-ins look like ordinary traffic. RealGround analysis: this is relevant to fintech AI risk because compromised finance-related mailboxes can expose payment instructions, approvals, and sensitive business communications, increasing the likelihood of fraud and business email compromise.