Ongoing Azure Compromises Target Senior Execs, Microsoft 365 Apps

Researchers have observed an ongoing, sophisticated campaign targeting Microsoft Azure and Microsoft 365 corporate clouds that has compromised dozens of environments and hundreds of user accounts. Threat actors use highly tailored phishing lures to harvest credentials, register their own MFA methods, move laterally through Exchange Online to exfiltrate sensitive data and execute financial fraud, and create mailbox rules to hide their activity; a Linux user-agent has been identified as an indicator of compromise. Organizations are advised to enforce strong password hygiene, monitor for the identified IoC, and deploy auto-remediation policies to limit damage.