The Ghost in the Machine: How a Multi-Stage Phishing Campaign Evades Security to Steal Microsoft 365 Credentials

KnowBe4 Threat Labs describes an active, highly sophisticated multi-stage phishing campaign (observed since November 3, 2025) that uses nested PDF attachments and legitimate CDN services to obfuscate a credential-harvesting webpage which implements nine advanced evasion techniques (DevTools detection, anti-debugging, viewport monitoring, hidden honeypot fields, behavioral mouse tracking, console overrides, text obfuscation, network monitoring, etc.) and a real-time man-in-the-middle relay that leverages Microsoft infrastructure to validate credentials and relay MFA challenges, enabling immediate takeover of Microsoft 365 accounts; recommended mitigations include layered cloud email security, blocking identified IOCs, auditing MFA authentications, and user awareness training.