Microsoft uncovers AiTM phishing abusing SharePoint sharing

The Microsoft Defender Security Research Team has uncovered a complex, multi-stage adversary-in-the-middle phishing campaign that abuses SharePoint file-sharing services. The campaign also incorporates business email compromise techniques and has targeted multiple organisations, particularly in the energy sector. The attackers used these methods for credential theft and unauthorised access while evading detection and standard remediation such as password resets. Microsoft advises organisations to revoke active sessions, review inbox rules and enforce conditional access policies, since password resets alone may be insufficient against AiTM attacks.

What this means for your organisation

The key point in this advisory is that the standard response does not work. When the attacker holds a valid session token, access continues after the password is changed, and many organisations close the incident early on a false premise. Using SharePoint sharing links as the carrier makes it harder still, because the link arrives from a sender and a system the recipient already trusts.

Berigo recommends

• Make revoking active sessions a fixed step in your account compromise playbook, not just a password reset.
• Review inbox and forwarding rules on affected accounts, since attackers frequently leave them behind.
• Enforce conditional access with device compliance requirements, and use phishing-resistant authentication.
• Monitor SharePoint sharing to external recipients and limit who can share broadly.

Source

• microsoft.com