Microsoft has issued an alert regarding a highly sophisticated phishing campaign aimed specifically at organizations in the energy sector. The attacks rely on an “Adversary-in-the-Middle” (AiTM) technique that enables threat actors to harvest user credentials and hijack corporate email accounts.
How the Attack Works
The campaign begins with emails that appear to originate from trusted business partners with whom the victim organization already has an established relationship. The subject line typically references a routine item such as “NEW PROPOSAL – NDA,” making the message appear legitimate and relevant to daily operations. What increases the effectiveness of this tactic is that the attackers are using already-compromised, real email accounts, which allows the messages to pass standard authenticity checks.
Each email contains a link presented as a SharePoint document. Because the message and sender appear legitimate, many email security controls fail to flag the communication as suspicious.
When the recipient clicks the link, they are redirected to a counterfeit login page that closely mirrors the legitimate sign-in experience. Any credentials entered on this page are immediately captured by the attackers. In addition to usernames and passwords, the phishing page also collects session cookies—tokens that confirm an authenticated session.
Using the stolen session cookies, the attackers access the compromised account from their own infrastructure, observed at IP addresses 178.130.46.8 and 193.36.221.10. Their first action is to create hidden inbox rules that automatically mark incoming messages as read and delete them. This effectively blinds the legitimate user to security notifications or warning emails.
Once control of the mailbox is established, the attackers escalate the operation by sending the same phishing email to all contacts associated with the compromised account, often reaching hundreds of recipients. To conceal their activity, they delete bounce-back notifications and automated replies from the mailbox.
If recipients reply to question the legitimacy of the message, the attackers respond while impersonating the account owner, assuring them that the request is valid. These conversations are then removed to eliminate evidence. Any recipient who engages with the phishing link becomes another compromised user, allowing the attack to propagate rapidly across organizations and supply chains.
How to Fix and Prevent This
According to Microsoft’s security team, mitigating these attacks requires actions beyond standard password resets.
In affected environments, organizations must invalidate all active session cookies to force reauthentication, identify and remove malicious inbox rules, and review accounts for unauthorized multi-factor authentication changes.
Multi-factor authentication (MFA) remains an essential security control, even though AiTM attacks are designed to bypass certain MFA implementations. MFA continues to protect against many other common attack vectors and significantly reduces overall risk.
That said, not all MFA methods provide the same level of protection. Stronger, phishing-resistant options include hardware security keys (FIDO2), passwordless authentication using device-bound biometrics (passkeys), and certificate-based authentication. These approaches are far more difficult for phishing campaigns to compromise than traditional SMS-based verification codes.