Hackers Clone Microsoft Login Portals to Capture Credentials and Session Tokens in Real Time

Severity

Medium

Researchers from Infoblox Threat Intel have identified an active Adversary-in-the-Middle (AiTM) phishing campaign that targets Microsoft 365 users by cloning legitimate Microsoft authentication pages. Unlike conventional phishing attacks that only steal usernames and passwords, this campaign intercepts login credentials, Multi-Factor Authentication (MFA) codes, and authenticated session tokens in real time, allowing attackers to hijack user sessions without bypassing the authentication process.

The campaign has been active since at least May 2026 and has targeted universities, commercial organizations, multinational enterprises, as well as government-related institutions, including agencies within the European Union and the United Nations. Researchers observed the attackers using multiple Phishing-as-a-Service (PhaaS) frameworks, including EvilProxy, FlowerStorm (Storm-1167), and Kali365, while hosting phishing infrastructure on compromised aged domains to evade traditional security controls.

How?

The attack begins with phishing emails sent from previously compromised Microsoft Outlook or organizational email accounts, making the messages appear legitimate. These emails commonly impersonate procurement requests, Requests for Information (RFIs), bid invitations, or confidential project documentation to encourage recipients to open malicious links.

Victims who click the embedded links are redirected to fake document download portals that closely resemble legitimate business platforms. Before accessing the final page, users are required to complete an email verification step and a CAPTCHA or Cloudflare Turnstile challenge, helping attackers prevent automated security analysis.

After passing these checks, victims are presented with a cloned Microsoft login page that impersonates their organization. The phishing infrastructure acts as a live reverse proxy, forwarding the victim’s credentials and MFA responses directly to Microsoft’s legitimate authentication servers. At the same time, it captures the session cookies and OAuth tokens returned after successful authentication.

By stealing these authenticated session tokens, attackers can gain access to Microsoft 365 accounts without needing the user’s password or triggering additional MFA requests. Since authentication occurs through Microsoft’s legitimate infrastructure, conditional access policies may recognize the login as valid, allowing attackers to maintain persistent access while avoiding traditional password-reset or MFA alerts.

Recommendations

Organizations should strengthen identity protection by deploying phishing-resistant MFA, such as FIDO2 security keys or WebAuthn, which cryptographically bind authentication to legitimate websites and prevent reverse-proxy attacks from stealing usable session tokens.

Security teams should enforce Conditional Access policies that require access only from compliant and managed devices, limiting the usefulness of stolen session tokens. Continuous monitoring of Microsoft 365 sign-in logs for unusual login locations, unfamiliar devices, abnormal user agents, and suspicious session activity can help identify compromised accounts early.

In addition, organizations should educate users to verify login pages before entering credentials, especially when accessing links received via email. Security monitoring should also include passive DNS analysis, detection of suspicious domain patterns, and inspection of compromised aged domains that may be reused for phishing infrastructure. Prompt investigation of suspicious emails and compromised accounts can help prevent attackers from expanding access within the environment.

Source

https://gbhackers.com/hackers-clone-microsoft-login-portals/