MICROSOFT FLAGS MULTI-STAGE AITM PHISHING AND BEC ATTACKS TARGETING ENERGY FIRMS

Summary from the TLDR InfoSec newsletter

Microsoft describes a layered phishing and BEC campaign against energy companies that abuses trusted services like SharePoint and OneDrive to deliver links leading to adversary-in-the-middle credential theft pages. Attackers then use stolen credentials and session cookies to set stealthy inbox rules, launch large internal and external phishing waves, and bypass MFA using tailored phishing kits and social engineering, prompting defenders to adopt phishing-resistant MFA, conditional access, continuous access evaluation, and robust anti-phishing controls.