Hackers Target US and EU Firms With Microsoft 365 Session Hijacking and RMM Abuse

A coordinated August campaign abused widely trusted tools and phishing-as-a-service kits (Mirage2FA, 3DBlast) to perform AiTM session hijacking of Microsoft 365 accounts, install RATs like SnakeBiteAgent, and deploy signed remote-management software to maintain stealthy persistent access; researchers also tie suspected Lazarus-linked operatives ('Famous Chollima') using fake remote-hire identities to gain internal access. Organizations are advised to revoke active tokens, adopt phishing-resistant MFA, strengthen remote-hire identity checks, and use behavioral threat intelligence and sandboxing to detect rotating attacker infrastructure.