Arctic Wolf has detected an ongoing Microsoft 365 phishing campaign targeting organizations within healthcare, education, manufacturing, government, professional services, and other sectors across the United States, Canada, and Europe. The AiTM proxy relays the real Microsoft login process in real time, allowing victims to complete MFA on what appears to be a legitimate sign-in page. Victims are directed to click on an "OPEN [Organization] VOICEMAIL PORTAL" button, often following a pattern similar to: [Organization] :ATTN: Review messages.
Ref id: [random string] A multi-stage redirection scheme employs Google Meet links, Google Ads, and AWS S3 hosting to funnel victims towards a man-in-the-middle (MitM) phishing gateway.
This layered redirection mechanism allows attackers to bypass reputation-based security measures by utilizing legitimate services such as Google Meet link redirects, Google Ad infrastructure, Campaign Manager click tracking, and Amazon S3-hosted content. It then fingerprints the user agent string through an API call that includes country information (e.g., api[.]country[. ]is), storing the result in a cookie for seven days and redirecting the user to the proxied OAuth authorization endpoint.
JavaScript gathers detailed data about the browser, operating system, screen settings, language preferences, timezone, hardware capabilities, WebGL details, cookies, and WebDriver configurations. Some affected accounts displayed rapid sign-ins from multiple residential IP addresses, unusual browser and operating-system combinations, and Microsoft error code 90014 linked to OfficeHome authentication.
