Crooks hook hundreds of exec accounts after phishing in Azure C-suite pond

Proofpoint researchers identified an ongoing targeted phishing campaign, active since November, that has produced hundreds of cloud account takeovers and compromised dozens of Azure environments. Attackers targeted C-suite and senior staff to steal sensitive files and credentials, abused mailboxes for lateral movement and phishing, manipulated MFA (registering authenticator apps and phone numbers), used mailbox rules and proxy services to evade detection, and leveraged localized ISPs to blend in. Recommended mitigations include monitoring for IoCs (notably a Linux Chrome user-agent), enforcing credential resets, hardening detection of ATOs, and implementing auto-remediation policies.