Hackers spoof Microsoft ADFS login pages to steal credentials

Abnormal Security discovered a targeted help-desk phishing campaign that impersonates corporate IT and presents realistic spoofed ADFS login portals to capture usernames, passwords, and second-factor authentication (including Microsoft Authenticator, Duo, and SMS). Attackers immediately use stolen credentials to access corporate mail, create forwarding rules, perform lateral phishing, and conduct business email compromise; they also use VPN services to obscure their origin. Abnormal recommends migrating to modern authentication solutions (e.g., Microsoft Entra) and improving email filtering and anomaly detection to mitigate these attacks.