Researchers Uncover Multi-Stage AiTM Attack Using SharePoint to Bypass Security Controls

Microsoft Defender reported a sophisticated AiTM phishing and BEC campaign targeting energy sector organizations that abused SharePoint file-sharing to bypass email controls, harvest credentials and session cookies, create malicious inbox rules, and send over 600 malicious emails; attackers also registered MFA methods to maintain persistence. Recommended actions include auditing inbox rules, revoking session cookies, reviewing anomalous sign-ins, and applying risk-based conditional access. IOCs listed: 178.130.46.8, 193.36.221.10.