Reported by 2 outlets

Timeline

1. original reporting

   Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud

   gbhackers.com · 54d ago · August 20th, 2026

   Threat actors are increasingly abusing Microsoft 365 identity sessions rather than deploying malware, as shown in a cloud-only business email compromise (BEC). The attackers used an adversary-in-the-middle (AiTM) phishing kit to capture an authenticated Microsoft 365 session token, bypass multi-factor authentication, and quietly redirect vendor payments to attacker-controlled bank accounts. The lure contained a “View […] The post Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Hackers Bypass Microsoft 365 MFA With AiTM Phishing to Hijack Mailbox and Divert Vendor Payments

   cyberpress.org · 54d ago · August 20th, 2026

   Cybercriminals bypassed Microsoft 365 multi-factor authentication (MFA) through an Adversary-in-the-Middle (AiTM) phishing attack, hijacked a finance employee’s active session, and used mailbox access to divert vendor payments to attacker-controlled bank accounts. The campaign was fully cloud-based, leaving no malware or endpoint compromise behind. The attack began with a targeted HR-themed email claiming that the recipient’s paid-time-off request had been denied. The message included a “View PTO Conflicting Dates” button hidden behind a SendGrid tracking link. After the finance user clicked, the link passed through several redirects before opening a fake Microsoft 365 sign-in page. The AiTM phishing infrastructure acted as a relay between the victim and the legitimate Microsoft service. It captured the password and, more importantly, the authenticated session cookie after the user approved the MFA prompt. Microsoft 365 MFA Bypass This allowed the attackers to replay the valid Microsoft 365 session from commercial VPN infrastructure . Because MFA had already been satisfied in the stolen token, the attacker did not need to trigger a new MFA request or guess credentials. Sign-in records showed single-factor authentication with MFA marked as “previously satisfied,” a key indicator of session-token replay. The threat actor used the hijacked session to access Exchange Online, SharePoint, Microsoft 365 Search, and a shared accounts-payable mailbox available through the victim’s exi