[CLSTR]
< Back to situation

[REVISION HISTORY]

Microsoft 365 phishing and MFA bypass threats

Updated 6 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-20 12:33 UTC → 2026-10-23 21:17 UTC · added removed

Cybersecurity researchers have identified evolving phishing threats specifically targeting Microsoft 365 environments. Initially, the discovery of the ‘NovaCookies’ phishing-as-a-service toolkit revealed a subscription-based model designed to bypass multi-factor authentication (MFA) via adversary-in-the-middle (AiTM) techniques. This toolkit, which operates for approximately $320 per month and is reportedly managed via Telegram, has targeted hundreds of organizations globally. Proofpoint has assessed NovaCookies as a variant of the Sneaky 2FA phishing kit, noting it now includes dedicated flows for other identity providers like Okta and Entra domains federated to GoDaddy. Recent intelligence highlights major operations like PREY-0058 and BigBear 2.0, which utilize AiTM frameworks such as Evilginx2. These operations route traffic through residential proxies to mimic legitimate user locations, enabling attackers to intercept authenticated session cookies. CloudSEK reported that BigBear 2.0 targeted 461 organizations across more than 40 countries. Attackers are also employing vishing to trick executives into visiting fraudulent authentication pages. In Austria, researchers noted that cybercriminals are becoming more professional through the use of artificial intelligence, while regional warnings in Germany emphasize that even established MFA may not provide reliable protection. Newer tactics involve exploiting legitimate Microsoft services, such as OAuth authentication flows and Microsoft Teams, to build credible deceptive paths. Check Point Research identified a campaign targeting over 120 organizations using fake Microsoft Teams notifications disguised as urgent HR updates to trick users into granting malicious application permissions. To evade security filters, attackers are generating fraudulent credential-stealing pages dynamically within the victim’s browser using a blob URL, which exists only in local session memory. Consequently, Microsoft has become the primary target for brand impersonation phishing, accounting for 33% of all such attempts in the third quarter of 2026—approximately four times In late September 2026, Microsoft, Coinbase, and international law enforcement dismantled ‘EvilTokens’, an AI-powered phishing-as-a-service platform. EvilTokens targeted the frequency of any other brand. Microsoft OAuth 2.0 device-code authentication flow to hijack session tokens and bypass MFA.

Versions

  1. 2026-10-23 21:17 UTC Microsoft 365 phishing and MFA bypass threats
  2. 2026-10-20 12:33 UTC Microsoft 365 phishing and MFA bypass threats
  3. 2026-10-18 13:44 UTC Microsoft 365 phishing and MFA bypass threats
  4. 2026-09-23 02:14 UTC Microsoft 365 phishing and MFA bypass threats
  5. 2026-09-20 05:43 UTC Microsoft 365 phishing and MFA bypass threats
  6. 2026-09-09 02:35 UTC Microsoft 365 phishing and MFA bypass threats
  7. 2026-09-08 08:01 UTC Microsoft 365 phishing and MFA bypass threats

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.