New AiTM Attack Campaign That Bypasses MFA Targeting Microsoft 365 and Okta Users
A recent phishing campaign has been identified that effectively bypasses multi-factor authentication (MFA) for Microsoft 365 and Okta users, posing a significant risk to organizations using these platforms for identity management.
A recent phishing campaign has been identified that effectively bypasses multi-factor authentication (MFA) for Microsoft 365 and Okta users, posing a significant risk to organizations using these platforms for identity management.
Discovered in early December 2025, the campaign reveals advanced understanding of authentication processes. It targets organizations across various sectors through phishing emails disguised as HR and benefits notifications.
The phishing campaign utilizes sophisticated techniques to intercept legitimate single sign-on (SSO) workflows, allowing attackers to capture user credentials and session tokens before MFA can prevent unauthorized access. Attackers have registered several lookalike domains such as sso.okta-secure.io, sso.okta-cloud.com, and sso.okta-access.com to mimic authentic authentication pages.
The phishing emails originate from compromised Salesforce Marketing Cloud accounts and use compensation-related lures. They include shortened links that redirect recipients to initial phishing domains hosted on Cloudflare infrastructure. The attack remains active, with numerous organizations reporting incidents.
Discovered in early December 2025, the campaign reveals advanced understanding of authentication processes.
The attack involves a two-stage phishing process leveraging JavaScript-based credential harvesting. Initially, attackers proxy legitimate Okta pages, injecting malicious scripts that capture usernames and monitor session cookies. These scripts continually track critical cookies such as idx, JSESSIONID, proximity_, DT, and sid, essential for maintaining authenticated sessions.
JavaScript-Based Credential Capture Mechanism
The phishing technique exploits the window.fetch method to redirect legitimate requests from Okta to the attacker’s phishing domain. It captures user credentials via DOM event listeners, storing them in localStorage, sessionStorage, and cookies, ensuring persistence across page navigations or storage clearances.
For users employing Okta with Microsoft 365, the attack monitors responses from Microsoft's authentication endpoint, modifying the FederationRedirectUrl field to redirect users to a second-stage phishing page. This seamless redirection proxies all traffic to the legitimate Okta tenant, facilitating unauthorized access with captured session cookies.
Organizations should scrutinize Okta logs for auth_via_mfa events with mismatched Cloudflare IP origins and implement phishing-resistant MFA methods like FIDO2 security keys to counter such attacks.
Based on reporting by Cyber Security News.