Threat Actors Leverage SharePoint Services in Sophisticated AiTM Phishing Campaign

Microsoft Defender disclosed a sophisticated AiTM phishing campaign targeting energy sector organisations by abusing SharePoint links from a compromised vendor account to harvest credentials and session cookies, then establishing persistence (malicious inbox rules, MFA manipulation) and conducting mass BEC operations across multiple organisations; Microsoft published two IP IoCs and recommended revoking session cookies, removing inbox rules, resetting MFA, and implementing conditional access and advanced anti-phishing defenses.