Observing Atlas Lion (part two): Winning the battle, with an eye on the war

Atlas Lion conducted an SMS phishing campaign that yielded ~18 credentials (9 with new MFA devices), attempted to onboard an attacker-controlled VM to a corporate domain, and then used compromised accounts to perform rapid automated reconnaissance across 19 applications and hundreds of SharePoint items to locate BYOD, device management, VPN details and gift-card processes; they also abused internal ticketing to escalate Confluence access but were detected and stopped before stealing gift cards.