Microsoft researchers have warned about a large-scale phishing campaign that can hijack user accounts even when they’re protected with multi-factor authentication (MFA).

This campaign has targeted more than 10,000 organisations since September 2021, according to Microsoft’s threat data. Once they’re in, the attackers use the stolen credentials and session cookies to access the victim’s mailbox and perform follow-on campaigns against other targets.

In recent years, organisations have upped their security practices in the form of MFA, as relying on a single factor such as a password can be weak for many reasons.

However, Microsoft said this cybercrime campaign is managing to circumvent the security measure through adversary-in-the-middle (AiTM) phishing.

In these cases, the attacker deploys a proxy server between a target user and the website the user wishes to visit. Microsoft said this impersonation lets the attacker steal both the password and the session cookie that proves their ongoing and authenticated session with the website.

Microsoft said these session cookies allow the attacker to skip the entire authentication process. The company noted in the report that this is not a vulnerability of MFA itself.

“Since AiTM phishing steals the session cookie, the attacker gets authenticated to a session on the user’s behalf, regardless of the sign-in method the latter uses,” Microsoft said in a blog post.

In this phishing campaign, Microsoft said the attackers are targeting Office 365 users by spoofing the Office online authentication page. The company noted that these proxy sites are difficult to spot, as the URL is the only visible difference between the phishing site and the actual one.

Once the threat actors have access, they were able to access employee email accounts and  trick targets into wiring large sums of money, which the victims think is being sent to co-workers or business partners.

To avoid detection, the attackers would also set up Inbox rules so certain emails would be automatically moved to an archive folder and marked as read. They also deleted their own emails from the sent items folder.

“On one occasion, the attacker conducted multiple fraud attempts simultaneously from the same compromised mailbox,” Microsoft said. “Every time the attacker found a new fraud target, they updated the Inbox rule they created to include these new targets’ organisation domains.”

Microsoft said organisations should consider complementing MFA protection with additional identity-driven signals such as user or group membership, IP location information and device status.

10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.

The post Microsoft warns of massive phishing campaign that can bypass MFA appeared first on Silicon Republic.