Hackers Clone Microsoft Login Portals to Capture Credentials and Session Tokens in Real Time

An active adversary-in-the-middle (AiTM) phishing campaign that clones Microsoft authentication pages to intercept credentials, Multi-Factor Authentication (MFA) codes, and session tokens in real time.

Rather than relying on simple password harvesting, this technique hijacks authenticated user sessions directly.

Detailed by Infoblox Threat Intel researchers Darby Wise and Nick Sundvall, the widespread campaign has targeted universities, commercial enterprises, and multinational institutions including European Union and United Nations agencies since at least May 2026.

Hackers Clone Microsoft Login Portals

The intrusion pipeline begins with targeted phishing emails dispatched from previously compromised organizational mailboxes.

Using legitimately compromised accounts lends immediate credibility to the messages, allowing threat actors to pivot from a small initial foothold into a broad, organization-wide distribution of identical lures.

These emails are themed around procurement workflows, Requests for Information (RFIs), competitive bid invitations, and confidential project documentation.

To prevent targets from out-of-band verification, the messages are reinforced with fake deadlines and strict confidentiality language.

When victims click the embedded links, they are routed through fake document-download platforms—such as spoofed ConstructConnect or project management portals with the victim’s email address pre-populated in the URL string.

Before reaching the final landing page, targets must pass an email verification prompt alongside a CAPTCHA or Cloudflare Turnstile challenge designed to block automated security crawlers.

Once passed, victims arrive at a cloned Microsoft login page tailored to impersonate the targeted organization, such as the European Investment Bank.

Unlike traditional static phishing pages that only store submitted text forms, this AiTM framework operates as a live reverse proxy.

When a victim inputs their login credentials and completes an MFA prompt, the proxy relays those inputs to Microsoft’s actual authentication endpoints in real time.

Simultaneously, the proxy intercepts the resulting session cookies and OAuth tokens returned by Microsoft. This architecture allows the operator to establish a fully authenticated session without cracking passwords or defeating MFA infrastructure.

Because the authentication flow completes natively on Microsoft’s legitimate servers, conditional access policies see a valid login while the session token is silently exfiltrated.

Further operational insights on this adversary-in-the-middle infrastructure are detailed in the AiTM Phishing Campaign analysis by Infoblox.

Once stolen, the session token grants persistent tenant access, letting threat actors bypass conditional access controls and navigate victim environments without triggering password-reset alerts or secondary MFA prompts.

Infoblox Threat Intel researchers warn that standard MFA alone cannot mitigate this attack vector because the login process is completed within infrastructure controlled directly by the adversary.

To maintain operational resilience and evade perimeter filters, the threat actor rotates across multiple Phishing-as-a-Service (PhaaS) frameworks:

Phishing Kit	First Observed	Core Operational Technique	Primary Targeted Sectors
EvilProxy	2022	Reverse proxy session interception	Broad, low-skill PhaaS use across all global sectors
FlowerStorm / Storm-1167	June 2024	Reverse proxy credential & token harvesting	Microsoft 365 tenants in finance, legal, and manufacturing
Kali365	April 2026	Device code abuse paired with AiTM capture	Microsoft 365 environments via tiered reseller models

The group generates attack domains using combinations of corporate buzzwords combined with .de, .net, or .com top-level domains. These tactics mirror broader MFA bypass methods used across modern credential harvesting operations.

Rather than registering brand-new domains, the operators frequently compromise dormant, aged domains, some inactive for nearly a decade.

By injecting malicious PHP scripts to host the fake document download portals, the attackers retain the domain’s historical reputation while reusing its underlying infrastructure.

Defensive Implications and Countermeasures

Standard detection strategies relying on static domain reputation or URL inspection are losing efficacy against infrastructure that leverages aged domain reuse. Security teams must adapt by adopting multi-layered defenses:

• Passive DNS Analysis: Monitor for Registered Domain Generation Algorithm (RDGA) patterns and suspicious subdomain structures to detect infrastructure before campaigns go live.
• Phishing-Resistant MFA: Deploy FIDO2 hardware keys or WebAuthn standards that cryptographically bind authentication to the specific domain origin, rendering reverse-proxy token theft ineffective.
• Device Compliance Enforcements: Enforce conditional access policies that require compliant, managed devices to access corporate Microsoft 365 resources.
• Behavioral Monitoring: Set alerts for anomalous sign-in properties, unusual geographic locations, or unexpected user-agent strings immediately following email click events.

Implementing these advanced controls is critical to combating evolving phishing attack techniques that target enterprise identity providers.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide