Quick Summary
Organizations in the energy sector are facing a sophisticated phishing campaign aimed at compromising enterprise accounts, as warned by Microsoft. The attacks begin with emails containing the subject line “NEW PROPOSAL – NDA” from compromised addresses, leading users to fake login pages. Attackers can then intercept session cookies, delete incoming emails, and send further phishing emails to contacts, demonstrating the complexity of AiTM phishing attacks.
The Securityish Brief
Microsoft has reported a targeted phishing campaign against organizations in the energy sector, utilizing AiTM (Adversary-in-the-Middle) techniques to compromise enterprise accounts. The attacks began with phishing emails featuring the subject line “NEW PROPOSAL – NDA,” sent from compromised email addresses belonging to trusted organizations. These emails included links to fake login pages designed to capture user credentials and session cookies.
Once attackers obtain a session cookie, they can sign in from different IP addresses (178.130.46.8 or 193.36.221.10) and create inbox rules to delete incoming emails and mark others as read. This method allows them to evade detection while launching further phishing attacks against the compromised user’s contacts.
This campaign highlights the operational complexity of AiTM phishing, necessitating remediation strategies that go beyond standard identity compromise responses. Microsoft emphasizes that simply resetting passwords is inadequate; organizations must also revoke active session cookies and remove any inbox rules created by attackers.
Additionally, organizations should verify that no new multi-factor authentication (MFA) policies have been established by attackers, which could allow unauthorized access via one-time passwords sent to mobile devices. While MFA is crucial in preventing many types of attacks, the AiTM phishing technique specifically targets vulnerabilities in MFA implementations.
To enhance security, organizations are encouraged to adopt AitM-resistant authentication methods, such as FIDO2 security keys, passkeys, and certificate-based authentication. These methods provide stronger defenses against credential theft and unauthorized access.
- FIDO2 security keys: These are hardware devices that provide a secure method of authentication, reducing the risk of phishing.
- Passkeys: This method allows for FIDO2 authentication without needing a separate hardware key, simplifying secure access.
- Certificate-based authentication: This technique uses digital certificates to verify user identities, enhancing security against unauthorized access.
Key Takeaways
- Verify that your organization has implemented strong multi-factor authentication (MFA) to protect against unauthorized access.
- Regularly review and revoke any active session cookies that may have been compromised during phishing attacks.
- Educate employees about recognizing phishing emails, particularly those with familiar subject lines and links.
- Implement AitM-resistant authentication methods, such as FIDO2 security keys or passkeys, to enhance account security.
- Monitor email inbox rules to ensure no unauthorized changes have been made that could facilitate phishing attacks.
Key Terms & Concepts
- AiTM: In this article, AiTM refers to Adversary-in-the-Middle, a phishing technique that intercepts user credentials.
- MFA: MFA stands for multi-factor authentication, a security measure that requires multiple forms of verification to access accounts.
Read the original article here: https://www.helpnetsecurity.com/2026/01/22/energy-sector-aitm-phishing-sharepoint-misuse/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
