Atlas Lion Campaign Exploits Device Enrollment and MFA for Persistence (Campaign)

Atlas Lion executed an SMS phishing campaign to harvest user credentials and MFA codes, registered an attacker-controlled Azure VM into the target environment to onboard a malicious MFA device, and leveraged validated credentials for rapid reconnaissance of internal services (SharePoint, Confluence) and privilege-escalation attempts; endpoint detections based on a known malicious IP triggered SOC response and removal of the attacker VM.