Arctic Wolf exposes MFA-bypassing BEC against Microsoft 365

Researchers at Arctic Wolf Labs have recorded a large-scale phishing campaign targeting Microsoft 365 accounts. The attackers use an adversary-in-the-middle (AitM) technique to intercept credentials and multi-factor authentication codes, then leverage the compromised sessions to collect correspondence from employees involved in financial processes — payroll, payments, and banking operations. According to the researchers, over the past month phishing emails have reached hundreds of organizations in the healthcare, education, manufacturing, government, and professional services sectors across the US, Canada, and Europe.

Multistage attack chain

The initial vector is phishing emails themed around voicemail messages. The victim is redirected through a six-stage redirect chain that abuses legitimate services to evade reputation-based filters:

1. Google Meet redirect link
2. Google outbound link infrastructure
3. Dynamic click tracker in Google Campaign Manager (/ddm/clk)
4. HTML object hosted in an Amazon S3 bucket
5. Final redirect to the AitM infrastructure
6. Proxied Microsoft OAuth sign-in page

The use of trusted Google and Amazon domains at intermediate stages allows the emails and links to slip past security filters that rely on domain reputation.

Fingerprinting and geolocation

The phishing pages execute JavaScript code to fingerprint the victim’s browser: they collect data about the operating system, screen size, browser language, time zone offset, cookie support, WebDriver status, WebGL vendor, and available browser APIs. The collected information is sent to a PHP endpoint via an HTTP POST request, after which the browser is redirected to the proxied Microsoft OAuth authorization endpoint.

In addition, the phishing kit queries the geolocation API api.country[.]is to determine the victim’s country. The result is stored in a cookie named rcfh_country with a lifetime of seven days. According to the researchers, this data is presumably used to select geographically appropriate proxy infrastructure for subsequent logins to compromised accounts.

Automation of post-exploitation

After gaining initial access, the attackers exhibit a characteristic behavior pattern that differs from typical BEC attacks. Reportedly, 11–24 hours after the initial compromise, automated logins begin at approximately eight-hour intervals, with rotation of residential proxy addresses. The session identifier (SessionID) remains unchanged, while the IP address, ASN, and geographic location vary — indicating centralized automation for refreshing each compromised session.

The researchers observed a number of anomalies in the login data:

• Implausible browser/OS combinations — mobile versions of Apple Safari or Google Chrome on Windows 10
• The client application is listed as Microsoft Outlook, but the user-agent string contains Firefox 131.0, Firefox 151.0, or Python Requests instead of the expected Edge
• The use of residential proxies masks malicious logins as normal consumer traffic

Targeted collection of financial correspondence

For reconnaissance within compromised tenants, the attackers use the Microsoft Graph API to enumerate users associated with payroll, HR, finance, and administrative functions. They then access messages containing information on salaries, invoices, payments, bank details, benefits, and internal documents.

Notably, in most of the investigated incidents, post-exploitation activity was limited to session maintenance, reconnaissance, and mailbox content collection. The researchers did not observe changes to MFA methods, device registrations, credential modifications, lateral phishing, or the creation of inbox rules. Such restraint reduces the opportunities for early detection based on monitoring account changes.

In isolated cases, manual activity was recorded: creation of rules that automatically move certain messages from the “Inbox” folder to “Deleted Items” while marking them as “read”. This points to a hybrid model in which operators intervene selectively, while automated infrastructure handles routine operations.

Links to known campaigns

According to Arctic Wolf, the activity described has tactical overlaps with campaigns by the Payroll Pirates group — a financially motivated threat cluster specializing in hijacking employee accounts to redirect payroll disbursements to attacker-controlled accounts. Individual aspects of these campaigns have been documented since early 2025. It should be noted that this attribution is based on the assessment of a single vendor and has not been confirmed by independent sources.

Recommendations for detection and protection

Given the specifics of this campaign — MFA bypass, use of residential proxies, and minimal post-exploitation activity — standard BEC detection mechanisms may prove ineffective. Recommended measures include:

• Session anomaly monitoring: track logins where the SessionID remains the same but the IP address, ASN, and geolocation change. Eight-hour intervals between logins are a characteristic indicator
• User-agent analysis: log discrepancies between the declared client application (Outlook) and the actual user-agent (Firefox, Python Requests)
• Browser/OS combination checks: mobile versions of Safari or Chrome on Windows 10 are a clear sign of spoofing
• Graph API access audit: monitor bulk user enumeration and mailbox access via Graph API, especially for mailboxes belonging to finance and HR staff
• Conditional access policies: enforce device compliance checks as a mandatory condition for accessing Microsoft 365 — this will significantly hinder the use of stolen sessions from unmanaged devices
• IOC blocking: the domain api.country[.]is can be blocked at the DNS or proxy level as an indicator of phishing infrastructure

The delay between initial compromise and the start of automated activity (11–24 hours), combined with the deliberate avoidance of typical BEC actions, makes this campaign particularly difficult to detect retrospectively. Organizations using Microsoft 365 should immediately review sign-in logs for the past 30 days for the anomalies described — user-agent mismatches, IP rotation while preserving the same SessionID, and unusual Graph API activity on behalf of accounts in financial departments.