New AiTM Attack Campaign Bypasses MFA to Target Microsoft 365 and Okta Users
Cybersecurity researchers at Datadog have identified a sophisticated adversary-in-the-middle (AiTM) phishing campaign targeting organizations utilizing Microsoft 365 and Okta for single sign-on (SSO) authentication.
Cybersecurity researchers at Datadog have identified a sophisticated adversary-in-the-middle (AiTM) phishing campaign targeting organizations utilizing Microsoft 365 and Okta for single sign-on (SSO) authentication.
This campaign employs advanced techniques to infiltrate legitimate SSO authentication flows and bypass multi-factor authentication methods that lack phishing-resistant capabilities. The attack primarily involves phishing emails disguised as year-end compensation reviews from ADP, a well-known HR and payroll service provider. These emails contain links hidden behind URL shorteners that lead to initial phishing domains hosted on Cloudflare infrastructure.
The phishing domains use HR and benefits-themed names such as employee-hr-portal.com, corporate-hr-portal.com, and mybenefits-portal.com, all registered through NameSilo. In some cases, attackers embed malicious links within password-protected PDF attachments, with credentials provided in the email body to avoid detection.
The campaign employs a two-stage attack mechanism aimed at Okta-federated Microsoft 365 environments. Initial phishing pages mimic genuine Microsoft 365 login interfaces and inject malicious JavaScript to monitor HTTP responses for the FederationRedirectUrl field. When a legitimate Microsoft endpoint indicates that a user utilizes Okta for authentication, the script intercepts the response and alters the federation URL to redirect users to secondary Okta phishing domains.
The attack primarily involves phishing emails disguised as year-end compensation reviews from ADP, a well-known HR and payroll service provider.
These secondary domains include sso.oktasecure.io, sso.okta-cloud.com, and sso.okta-secure.io. The phishing pages proxy all traffic to legitimate Okta tenants, preserving organizational customizations and branding elements to enhance authenticity.
The phishing infrastructure deploys a client-side credential stealer, inject.js , to monitor critical Okta session cookies. The campaign has been active since at least August 2025, with ongoing code improvements observed in December 2025.
The script captures usernames through event listeners on input fields and stores credentials in cookies. It checks for new cookies every second and exfiltrates critical session tokens via POST requests. Attackers employ various evasion techniques, including Cloudflare turnstiles, to centralize campaign management and monitor phishing effectiveness across multiple organizations.
Organizations using Okta FastPass can detect phishing attempts through user.authentication.auth_via_mfa events with outcomes labeled as FAILURE and reasons indicating "FastPass declined phishing attempt." Security teams should monitor events where debugContext.debugData.behaviors flag new devices and locations as POSITIVE, especially when combined with network.client.geoip.as.domain showing cloudflare.com.
Organizations are advised to implement phishing-resistant MFA methods and continuously monitor authentication logs for unusual patterns to defend against these evolving AiTM attacks.
Based on reporting by GBHackers.