AiTM phishing campaign against more than 10,000 Microsoft 365 organizations
Microsoft reported on July 12, 2022 that a phishing campaign had attempted to target more than 10,000 organizations since September 2021 using adversary-in-the-middle proxy sites. The proxies captured passwords and session cookies, letting attackers skip authentication even where MFA was enabled, then use mailboxes for business email compromise and payment fraud.
- Victim
- Multiple: more than 10,000 organizations targeted
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Sep 2021
- First disclosed
- Jul 12, 2022
- Actor
- Financially motivated
- Initial access
- Phishing (adversary-in-the-middle)
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Phishing-resistant MFA such as FIDO2 defeats the proxy, and token binding plus conditional access on device compliance limit replay of stolen session cookies.
Go deeper on SWI
- Technique: Attacker-in-the-middle phishing proxy
- Technique: Session cookie theft
- Product involved: Microsoft Entra ID
Sources
- From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud, Microsoft Security Blog, Jul 12, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
- Dropbox GitHub repositories stolen via CircleCI-themed phishing 2022 · Phishing (adversary-in-the-middle)
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
- Boeing Distribution breached by LockBit via Citrix Bleed session hijacking 2023 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). AiTM phishing campaign against more than 10,000 Microsoft 365 organizations. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-microsoft-aitm-phishing-bec/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.