Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users
Essential information
- Published
- 10/12/2025 18:35
- Modified
- 21/12/2025 18:57
- Tags
- 2025-12-10 adversary-in-the-middle credential-theft microsoft 365 okta phishing session hijacking sso
- Related entities
- 1 observables, 12 techniques (mitre), 39 others
Description
An active phishing campaign has been identified targeting organizations using Microsoft 365 and Okta for single sign-on. The campaign employs modern techniques to bypass multi-factor authentication and hijack legitimate SSO flows. It uses lookalike domains to impersonate Okta authentication pages and injects malicious JavaScript to steal credentials and session tokens. The attackers have also developed a sophisticated method to phish users who use Okta as an identity provider for Microsoft 365. The campaign's initial access vector involves phishing emails with lures related to compensation and benefits. The attackers use compromised mailboxes and Amazon SES to send these emails, and host their phishing infrastructure on Cloudflare.