Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint 

Microsoft Defender analysts report a sophisticated AiTM phishing and BEC campaign against the energy sector in which attackers abused trusted SharePoint links to harvest session cookies, created inbox rules to hide activity and persist, and conducted a large internal and external phishing campaign (600+ emails) that led to multiple account compromises; the report provides detections, remediation steps (including revoking session cookies and removing malicious inbox rules), recommended protections (MFA, conditional access, continuous access evaluation), and two attacker IP IOCs.