Microsoft 365 Phishing in 2026 — AiTM, Token Theft, and the End of TOTP

A facilities-management contractor in Utrecht receives an internal-looking email Friday 16:38 with a SharePoint-styled banner: 'Quotation_Q2_2026.pdf — opened by your colleague Eric'. The link goes to a Microsoft-branded login page that, by every visible cue, is the genuine M365 sign-in: lock icon, microsoft-styled UX, even a 'this is a real Microsoft sign-in' security note. The page is, in fact, a reverse proxy running Evilginx — every keystroke and every TOTP code is being relayed in real time to the real Microsoft endpoint while the attacker's server harvests the resulting session cookie. The contractor signs in, mistakes the cookie-handoff for a slow page load, then closes the tab when the page does not advance. Within forty seconds the attacker is signed in from a Russian IP using the stolen session cookie, has registered a new authenticator app, has created an inbox rule auto-forwarding every email containing 'IBAN' or 'wire' to an external address, and has dropped an OAuth app called 'Microsoft Document Sync' with mail.read scope. None of this fires the MFA prompt on the contractor's phone because the session is already established. By Monday morning the attacker has shadow-extracted six months of finance correspondence and pivoted to two suppliers using the contractor's compromised mailbox. Defence detection time: 17 days, when finance asks why a recurring invoice was rerouted.

Modern M365 phishing has four dominant variants in 2026. First and most damaging is Adversary-in-the-Middle (AiTM) credential and session theft using off-the-shelf reverse-proxy kits like Evilginx 3.x and EvilProxy commercial services. These render the real Microsoft sign-in page through a proxy hop on the attacker's domain, relay credentials and MFA codes in real time, and steal the resulting session cookies for replay. TOTP and push-based MFA are completely bypassed because the attacker has the user's authenticated session, not their credentials alone. Second is OAuth consent phishing (covered fully in its own module) — the attacker tricks the user into granting an attacker-controlled enterprise application a mail.read or full-tenant scope. Third is MFA fatigue / push-bombing: the attacker has the password (from a separate breach or AiTM run) and floods the user with push prompts at inconvenient hours until they tap 'approve' to make it stop. Fourth is token-replay via stolen refresh tokens from compromised endpoints — a less common but very high-impact variant seen in Storm-0558 and Midnight Blizzard. MITRE ATT&CK techniques: T1539 (Steal Web Session Cookie), T1566.002 (Spearphishing Link), T1621 (Multi-Factor Authentication Request Generation), T1606.002 (Forge Web Credentials: SAML Tokens), T1098.001 (Account Manipulation: Additional Cloud Credentials). The defensive playbook is identity-first: phishing-resistant MFA (FIDO2 / passkeys), conditional-access policies that bind sessions to compliant devices and known geos, continuous-access evaluation, OAuth consent restrictions, and mailbox-rule and OAuth-grant monitoring.

• Microsoft login pages whose URL is anything other than login.microsoftonline.com, login.live.com, account.microsoft.com, or your tenant's federated IdP — even one extra subdomain or character is suspect
• MFA prompts you did not initiate — push notifications, phone calls, or TOTP attempts on your authenticator app while you are not signing in
• Inbox rules in your account that you did not create — especially rules with 'mark as read', 'forward to external address', or 'move to RSS Feeds folder'
• Unfamiliar third-party apps in your 'My applications' (https://myapps.microsoft.com) or under tenant 'Enterprise applications' that you do not recognise
• Sign-in alerts from new countries, anonymous-proxy infrastructure, or 'unfamiliar location' messages — even if you dismiss the alert
• OneDrive / SharePoint sharing links to files you do not recognise, especially with .htm or .html extensions
• Emails appearing to be from Microsoft itself with a 'review unusual sign-in' link — verify by going directly to https://account.microsoft.com
• Voice or SMS follow-up shortly after dismissing a suspicious M365 sign-in alert — coordinated multi-channel pretexts

1. Reject every MFA prompt you did not initiate — and then change your password from a known-clean deviceAn unsolicited prompt means the attacker has your password. Rejecting alone is not enough; the password must rotate immediately.
2. Always confirm the URL is on a legitimate Microsoft domain BEFORE entering credentialslogin.microsoftonline.com, login.live.com, account.microsoft.com, or your tenant's known federated IdP. Bookmark and use the bookmark.
3. Review your inbox rules, MFA methods and connected apps weeklyOutlook → Settings → Rules. Microsoft Account → Security → Sign-in activity + MFA methods. My Apps → installed enterprise apps. Anything unfamiliar = security ticket.
4. If you signed in to a suspicious page, report and revoke immediatelyEscalate to security. They will revoke sessions, force password rotation, re-enrol MFA, audit OAuth grants, and inspect mailbox rules. Speed matters — attackers exfiltrate within minutes.
5. Use phishing-resistant MFA wherever possible — passkeys are now first-class in M365Microsoft Entra ID supports passkeys natively in 2026. If your admin has enabled them, register one. They defeat AiTM, MFA fatigue, and token replay.
6. Treat any 'urgent SharePoint document review' email from outside your normal collaboration circle as hostile until proven otherwiseIf the content is genuinely relevant, the sender can reshare or you can confirm out-of-band.

• Microsoft — Adversary-in-the-Middle (AiTM) phishing campaigns[primary]
• Microsoft Entra — Phishing-resistant MFA guidance[primary]
• MITRE ATT&CK — T1539 Steal Web Session Cookie[primary]
• NCSC-NL — Cloud-identity-aanvallen[primary]
• Mandiant — UNC4393 / 0ktapus / Storm-0558 reports[secondary]
• Krebs on Security — Microsoft / Okta breach analyses[secondary]

• OAuth Consent Phishing — How Attackers Steal Mailbox Access Without Stealing Passwords

  9 min read

• Spear Phishing in 2026 — How Targeted Email Attacks Actually Work

  9 min read