Researchers Uncover Multi-Stage AiTM Attack Using SharePoint to Bypass Security Controls
Microsoft Defender researchers have identified an adversary-in-the-middle (AiTM) phishing campaign targeting organizations in the energy sector. This campaign exploits SharePoint file-sharing services to bypass traditional email security controls,…
Microsoft Defender researchers have identified an adversary-in-the-middle (AiTM) phishing campaign targeting organizations in the energy sector. This campaign exploits SharePoint file-sharing services to bypass traditional email security controls, leading to the compromise of multiple user accounts.
SharePoint Exploitation for Initial Access
The attack initiates with a phishing email sent from a compromised vendor email address, containing SharePoint URLs mimicking legitimate document-sharing workflows. Attackers leverage SharePoint's credibility to deliver malicious payloads that evade standard email detection mechanisms.
Upon user authentication and interaction with the SharePoint link, victims are redirected to a credential harvesting page designed to extract login credentials and session cookies.
Once credentials are compromised, attackers access accounts from different IP addresses and create malicious inbox rules to delete and mark emails as read, keeping victims unaware of the breach. Subsequently, a large-scale phishing campaign is launched, sending over 600 malicious emails to internal and external contacts identified from recent email threads.
The campaign escalates into business email compromise (BEC) operations with attackers monitoring victims’ mailboxes, deleting undelivered messages, and out-of-office replies. If recipients question the authenticity of phishing emails, attackers respond using compromised accounts to legitimize the messages before erasing all evidence.
Microsoft Defender researchers have identified an adversary-in-the-middle (AiTM) phishing campaign targeting organizations in the energy sector.
Secondary AiTM attacks target recipients who click on phishing URLs within the organization.
Microsoft Defender Experts have identified all compromised users by analyzing landing page IP addresses and sign-in patterns across multiple organizations. It is emphasized that password resets alone cannot remediate AiTM attacks. Organizations must revoke active session cookies, delete attacker-created inbox rules, and reverse any changes to multi-factor authentication (MFA) settings implemented by threat actors.
Attackers may establish persistence by registering additional MFA methods, maintaining access even after password changes.
Attacker infrastructure IPs: 178.130.46.8, 193.36.221.10
Organizations in the energy sector should audit inbox rules, review recent sign-in activity for anomalous IP addresses, and ensure MFA is complemented with risk-based conditional access policies to defend against session hijacking attacks.
Based on reporting by GBHackers.