AiTM phishing hijacks login sessions to enable business email fraud

A small logistics firm employee received a convincing email with a link to what appeared to be a legitimate cloud login page. After entering credentials and completing multi-factor authentication, the login seemed normal, but an attacker-in-the-middle relayed the process and captured the session cookie. The attacker then accessed the mailbox, created hidden inbox rules, and sent a fraudulent invoice with a changed bank account, which was stopped only by a phone verification. Microsoft reported in 2022 that such AiTM campaigns had targeted over 10,000 organizations since September 2021, and Japan's Anti-Phishing Council recorded about 2.45 million phishing reports in 2025.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.




Discussion (0)
Log in to join the discussion and vote.
Log in