AITM Attack Targeting Microsoft Email Users

ThreatLabz documents an active, large-scale AiTM phishing campaign targeting Microsoft email users—primarily enterprise customers across FinTech, Finance, Insurance, Energy and related sectors—where attackers use custom proxy-based kits to bypass MFA, abuse legitimate code-hosting services (CodeSandbox, Glitch) and open-redirectors for redirection, and apply browser fingerprinting and other cloaking techniques; the report details observed domain patterns, unique kit behaviors, post-compromise activity, and non-exhaustive IOCs.