[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

13 clusters · 77 sources · 61 days · First seen · Last updated

Microsoft 365 phishing and MFA bypass threats

Overview

Cybersecurity researchers have identified evolving phishing threats specifically targeting Microsoft 365 environments. Initially, the discovery of the ‘NovaCookies’ phishing-as-a-service toolkit revealed a subscription-based model designed to bypass multi-factor authentication (MFA) via adversary-in-the-middle (AiTM) techniques. This toolkit, which operates for approximately $320 per month and is reportedly managed via Telegram, has targeted hundreds of organizations globally. Proofpoint has assessed NovaCookies as a variant of the Sneaky 2FA phishing kit, noting it now includes dedicated flows for other identity providers like Okta and Entra domains federated to GoDaddy. Recent intelligence highlights major operations like PREY-0058 and BigBear 2.0, which utilize AiTM frameworks such as Evilginx2. These operations route traffic through residential proxies to mimic legitimate user locations, enabling attackers to intercept authenticated session cookies. CloudSEK reported that BigBear 2.0 targeted 461 organizations across more than 40 countries. Attackers are also employing vishing to trick executives into visiting fraudulent authentication pages. In Austria, researchers noted that cybercriminals are becoming more professional through the use of artificial intelligence, while regional warnings in Germany emphasize that even established MFA may not provide reliable protection. Newer tactics involve exploiting legitimate Microsoft services, such as OAuth authentication flows and Microsoft Teams, to build credible deceptive paths. Check Point Research identified a campaign targeting over 120 organizations using fake Microsoft Teams notifications disguised as urgent HR updates to trick users into granting malicious application permissions. To evade security filters, attackers are generating fraudulent credential-stealing pages dynamically within the victim’s browser using a blob URL, which exists only in local session memory. In late September 2026, Microsoft, Coinbase, and international law enforcement dismantled ‘EvilTokens’, an AI-powered phishing-as-a-service platform. EvilTokens targeted the Microsoft OAuth 2.0 device-code authentication flow to hijack session tokens and bypass MFA.

Entities

Microsoft · Kaspersky · Microsoft Entra · Check Point Research · Cloudflare

Claims

What the coverage asserts, and how many sources carry each claim.

Coverage disagrees

Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.

  • "More than 75,000 organizations were targeted by the attacks."

    vs

    "The platform compromised over 12,000 email inboxes across more than 10,000 organizations in 79 countries."

    One claim states the platform compromised more than 10,000 organizations, while the other states more than 75,000 organizations were targeted.

Timeline

  1. [TECHNOLOGY] 3 sources
    Phishing campaigns target organizations and hardware wallet users

    Global phishing campaigns are targeting 40,000 organizations via fake Microsoft Teams invites, while the Foundation hardware wallet manufacturer reports a data breach affecting customer contact info.

  2. [TECHNOLOGY] 8 sources
    Microsoft 365 token-replay attacks compromise 97 accounts

    Attackers used adversary-in-the-middle techniques to steal Microsoft 365 authentication tokens, bypassing MFA to compromise 97 accounts across 79 organizations.

  3. [TECHNOLOGY] 22 sources
    Microsoft to deploy AI-powered phishing detection in Teams

    Microsoft will launch AI-powered, context-aware phishing detection for Teams in November 2026 to identify social engineering and impersonation attempts without relying on malicious links.

  4. [TECHNOLOGY] 4 sources
    Microsoft targeted in 33% of brand phishing attacks

    Microsoft accounted for 33% of brand phishing attempts in Q3 2026, significantly outpacing Apple and Google as attackers target corporate credentials and AI platforms.

  5. [TECHNOLOGY] 3 sources
    Microsoft services exploited in new phishing campaign

    A new phishing campaign exploits legitimate Microsoft services and uses temporary blob URLs to steal credentials without hosting a traditional, detectable fraudulent website.

  6. [TECHNOLOGY] 2 sources
    Microsoft disrupts global phishing network sending 1 billion messages

    Microsoft and international partners dismantled a phishing network that sent over 1 billion fraudulent messages using specialized kits to steal credentials and data globally.

  7. [TECHNOLOGY] 2 sources
    Microsoft Teams phishing targets 30% of monitored organizations

    A report by Ontinue shows that 30% of monitored organizations were targeted by fake IT support scams via Microsoft Teams in early 2026, using vishing to exploit employee trust.

  8. [TECHNOLOGY] 5 sources
    Microsoft authentication systems exploited in phishing campaign

    Kaspersky detected over 31,000 phishing emails that exploit Microsoft Entra to redirect users to malicious sites via legitimate authentication links.

  9. [TECHNOLOGY] 4 sources
    Cybersecurity firms combat phishing via new tools and Microsoft service exploits

    Malwarebytes launches a free link-checking tool to combat phishing, while Kaspersky reports 31,000 scam emails exploiting Microsoft Entra infrastructure.

  10. [TECHNOLOGY] 29 sources
    Microsoft and partners dismantle AI-powered EvilTokens phishing network

    Microsoft and law enforcement have dismantled EvilTokens, an AI-powered phishing platform that compromised 12,000 inboxes by bypassing MFA via OAuth 2.0 device-code exploitation.

  11. [TECHNOLOGY] 3 sources
    Microsoft infrastructure exploited in sophisticated phishing campaigns

    Attackers are exploiting Microsoft infrastructure for phishing campaigns while using AI to create more convincing, personalized threats and prompt injection attacks against AI agents.

  12. [TECHNOLOGY] 6 sources
    Microsoft 365 users targeted by sophisticated MFA-bypass phishing attacks

    Cybercriminals are using advanced phishing and AiTM techniques to bypass MFA and hijack Microsoft 365 sessions, targeting organizations globally through sophisticated session cookie theft.

  13. [TECHNOLOGY] 2 sources
    NovaCookies phishing toolkit targets Microsoft 365 sessions

    NovaCookies, a $320-per-month phishing-as-a-service toolkit, is stealing Microsoft 365 sessions by bypassing MFA through adversary-in-the-middle attacks, targeting hundreds of global organizations.

Sources

acredia.at · ad-hoc-news.de · astig.ph · australiancybersecuritymagazine.com.au · b2b-cyber-security.de · bayreuther-tagblatt.de · bild.de · blick.ch · blogspan.net · borncity.com · businesstechweekly.com · chip.de · computerworld.com · criptonoticias.com.br · cryptobriefing.com · cybernoz.com · dev.to · developpez.net · digitaldaily.de · dinheirovivo.pt · distribuicaohoje.com · egyptindependent.com · epochtimes.de · etailment.de · finance.technews.tw · flagthis.com · hackerjournal.it · hackread.com · ibtimes.co.uk · iguru.gr · ilgiornaledisalerno.it · infoguerra.com.br · insuranceworld.gr · it-boltwise.de · it-daily.net · it-online.co.za · itmagazine.ch · itsection.com.br · itshow.com.br · kantonspolizei.ch · keyt.com · liratv.it · livecoins.com.br · malwarebytes.org · meinegemeinde.vol.at · mimikama.org · mindef.gov.sg · mittelstand-nachrichten.de

This summary has been updated 6 times: see revision history