Microsoft Warns of Global Campaign Stealing Auth Tokens From 35K Users

Key Takeaways

• 35,000 victims across 26 nations, 92% in U.S.
• Attack mimicked compliance emails, using polished HTML templates.
• AiTM flow captured authentication tokens, bypassing weak MFA.
• Threat leveraged legitimate email service and Cloudflare CAPTCHA.
• Microsoft urges Zero‑hour Auto‑Purge, Safe Links, passwordless authentication.

Pulse Analysis

The latest Microsoft‑reported phishing operation illustrates how threat actors are evolving beyond simple credential‑theft emails. By masquerading as internal compliance communications and employing high‑fidelity HTML designs, the attackers achieved a level of credibility that fooled even seasoned users. The use of a legitimate email delivery platform and a staged Cloudflare CAPTCHA added layers of authenticity, making automated filters less effective. This multi‑stage approach, culminating in an adversary‑in‑the‑middle token capture, signals a shift toward more complex, real‑time credential harvesting techniques.

Token interception directly undermines traditional multi‑factor authentication, especially when the second factor relies on push notifications or one‑time codes that can be replayed. Once an authentication token is stolen, attackers gain instant access without needing the user’s password again, rendering password‑based defenses obsolete. Enterprises must therefore accelerate the adoption of passwordless solutions, such as FIDO2 keys or biometric authenticators, and enforce conditional access policies that evaluate device health, location, and risk signals before granting privileged access.

Microsoft’s response emphasizes a layered security model: tightening Exchange Online Protection, enabling Zero‑hour Auto‑Purge, Safe Links, and Safe Attachments, and deploying Defender XDR for rapid detection and containment. Coupled with regular phishing simulations and security awareness training, these controls create multiple hurdles for attackers. As AiTM tactics become more prevalent, organizations that integrate automated threat disruption, robust identity governance, and continuous user education will be best positioned to protect critical data and maintain operational resilience.