Attackers Target Education Sector, Hijack Microsoft Accounts

Researchers from Abnormal Security observed an active phishing campaign that spoofs Microsoft ADFS single-sign-on pages to harvest credentials and bypass multifactor authentication, enabling account takeover. Approximately 150 organizations—primarily educational institutions—are targeted with personalized fake ADFS pages; attackers use captured credentials and MFA codes to pivot across SSO-connected services, perform reconnaissance, create mail rules to intercept communications, and execute lateral phishing. Recommended mitigations include migrating to modern identity platforms (e.g., Microsoft Entra), adopting phishing-resistant MFA, user training, and enhanced email filtering and behavior monitoring.