Microsoft Unveils Advanced Defense Techniques Against Evolving AiTM Attacks

Microsoft reports a rise in sophisticated AiTM phishing and social-engineering attacks targeting cloud identities — including use of phishing-as-a-service (e.g., Evilginx), OAuth device-code and consent phishing, tenant-based Teams abuse, and AI-enhanced lures. The advisory names multiple actor clusters employing these techniques and recommends defensive controls such as risk-based Conditional Access, phishing-resistant MFA and passkeys, Exchange/Defender protections, Zero Trust, app consent restrictions, and user training to reduce account compromise and lateral movement.