Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

What Happened

Cybercriminals launched a massive email scam targeting tens of thousands of employees, mostly in the United States. The emails falsely claimed the recipient was under a 'code of conduct' review and urged them to open an attached document. Clicking the link in the document took users through several fake security checks before asking them to log into their Microsoft account. This allowed the attackers to steal their login sessions and bypass standard security protections. Organizations should train employees to spot these fake alerts and upgrade to stronger, phishing-resistant login methods.

Key Takeaways

• A large-scale phishing campaign targeted over 35,000 users primarily in the US using 'code of conduct' and HR-themed lures.
• The attack chain utilizes legitimate email delivery services, PDF attachments, and multiple CAPTCHA gates to evade automated analysis.
• The final stage employs an Adversary-in-the-Middle (AiTM) framework to proxy authentication sessions and steal tokens.
• The AiTM technique successfully bypasses traditional, non-phishing-resistant Multi-Factor Authentication (MFA).
• The campaign uses device-specific redirection, sending mobile and desktop users to different malicious domains.

Affected Systems

• Microsoft 365 accounts
• Microsoft Entra ID
• Accounts relying on non-phishing-resistant MFA

Attack Chain

The attack begins with a phishing email posing as an internal 'code of conduct' review, sent via legitimate email services. The email contains a PDF attachment that directs the user to an attacker-controlled domain protected by a Cloudflare CAPTCHA. After passing the CAPTCHA and an intermediate staging page requiring an email address and a second CAPTCHA, the user is redirected to a device-specific AiTM phishing page. Here, the user is prompted to 'Sign in with Microsoft', allowing the attacker to proxy the authentication session, steal the resulting session token, and bypass MFA.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: Yes
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Microsoft Defender XDR

The article provides a KQL advanced hunting query for Microsoft Defender XDR to identify campaign emails based on known malicious sender addresses.

Detection Engineering Assessment

EDR Visibility: Low — This is primarily an identity and email-based attack. EDR on the endpoint will only see standard browser execution, as the malicious activity (token theft) occurs on the attacker's infrastructure. Network Visibility: Medium — Network logs can capture connections to the malicious domains, but the traffic is encrypted (HTTPS), limiting deep packet inspection. Detection Difficulty: Moderate — Detecting AiTM requires correlating email clicks with anomalous identity behaviors (like impossible travel or unfamiliar sign-in properties), which can be complex to tune without high false positive rates.

Required Log Sources

• Email Gateway Logs
• Identity Provider Logs (Microsoft Entra ID)
• Web Proxy / Secure Web Gateway Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Users clicking links in emails with HR or 'code of conduct' themes followed shortly by anomalous token usage or unfamiliar sign-in properties in Entra ID.	Email Gateway Logs, Entra ID Sign-in Logs	Credential Access	Medium
Inbound emails originating from external domains but utilizing display names mimicking internal compliance or HR departments.	Email Gateway Logs	Initial Access	Low

Control Gaps

• Non-phishing-resistant MFA (e.g., SMS, voice, standard push notifications)

Key Behavioral Indicators

• Anomalous Token alerts in Entra ID
• Impossible travel activity
• Unfamiliar sign-in properties for session cookies

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Block the identified malicious domains and sender email addresses at the email gateway and web proxy.
• Use Threat Explorer or Zero-hour auto purge (ZAP) to find and delete delivered phishing emails from user mailboxes.
• Revoke active sessions for any users suspected of interacting with the phishing links.

Infrastructure Hardening

• Enable phishing-resistant MFA methods such as FIDO2 keys, Windows Hello, or certificate-based authentication.
• Configure Conditional Access policies to strengthen privileged accounts with phishing-resistant MFA.
• Enable network protection in Microsoft Defender for Endpoint to block access to malicious sites.

User Protection

• Encourage the use of web browsers that support SmartScreen or similar anti-phishing technologies.
• Configure automatic attack disruption in Microsoft Defender XDR to contain attacks in progress.

Security Awareness

• Conduct phishing simulations using 'code of conduct' or HR-themed lures to train employees.
• Educate users on the risks of AiTM attacks and how to verify the legitimacy of authentication prompts and URLs.

MITRE ATT&CK Mapping

• T1566.001 - Phishing: Spearphishing Attachment
• T1566.002 - Phishing: Spearphishing Link
• T1556 - Modify Authentication Process
• T1550.004 - Use Alternate Authentication Material: Web Session Cookie
• T1036 - Masquerading

Additional IOCs

• Domains:
  • cocinternal[.]com - Attacker-controlled sender domain.
  • gadellinet[.]com - Attacker-controlled sender domain.
  • harteprn[.]com - Attacker-controlled sender domain.
  • na[.]businesshellosign[.]de - Attacker-controlled sender domain.
• Urls:
  • hxxps://login[.]managedservice365[.]blueprivacer[[.]]com/qnDaNmPM - Full URL for the mobile AiTM phishing page.
  • hxxps://login[.]managedservices365[.]assumetrend[[.]]org/yvFYpxLL - Full URL for the desktop AiTM phishing page.
• Other:
  • Awareness Case Log File – Tuesday 14th, April 2026.pdf - Malicious PDF attachment filename.
  • Disciplinary Action – Employee Device Handling Case.pdf - Malicious PDF attachment filename.
  • nationaladmin@gadellinet.com - Malicious sender email address.
  • nationalintegrity@harteprn.com - Malicious sender email address.
  • m365premiumcommunications@cocinternal.com - Malicious sender email address.
  • documentviewer@na.businesshellosign.de - Malicious sender email address.