Microsoft Warns of Multi-Stage AitM Phishing and BEC Attacks on Energy Sector

Microsoft has reported a sophisticated multi-stage adversary-in-the-middle (AitM) phishing and business email compromise (BEC) campaign specifically targeting multiple organizations within the energy sector. The attackers utilized SharePoint file-sharing services to deliver phishing payloads, leveraging compromised email accounts to send messages that appeared to originate from trusted sources. This approach allowed them to trick recipients into clicking on phishing links disguised as legitimate SharePoint document-sharing workflows.

The campaign’s operational complexity was underscored by the attackers’ ability to create inbox rules that deleted incoming emails and marked all messages as read, effectively evading user detection. In one instance, Microsoft noted that the attackers sent more than 600 phishing emails to contacts of a compromised user, both within and outside the organization. This tactic aimed to widen the scope of the attack and maintain persistence.

Microsoft emphasized that traditional remediation methods, such as password resets, are insufficient to address the threat posed by AitM attacks. Organizations must also revoke active session cookies and remove any inbox rules created by the attackers to regain control of compromised accounts. The incident illustrates the growing trend among cybercriminals to exploit trusted services like SharePoint and OneDrive, which are commonly used in enterprise environments.

Why This Matters for Your Security

This incident highlights the critical need for organizations to implement robust security controls, particularly in industries like energy that may be more vulnerable to targeted attacks. The use of phishing-resistant multi-factor authentication (MFA) and conditional access policies can significantly reduce the risk of falling victim to such sophisticated phishing campaigns.

Organizations should also consider continuous access evaluation and deploy anti-phishing solutions that actively monitor and scan incoming emails and visited websites. As attackers increasingly leverage trusted platforms to conduct their operations, maintaining vigilance and adapting security measures will be essential in protecting sensitive information and preventing unauthorized access.