35,000 users. 13,000 organisations. 26 countries. All hit in 48 hours.
Microsoft Defender Research has uncovered a phishing campaign that targeted more than 35,000 users at over 13,000 organisations across 26 countries between 14 and 16 April 2026. The lure? Fake workplace code-of-conduct emails. The payload? Stolen authentication tokens, lifted via an adversary-in-the-middle (AiTM) attack.
And here’s the uncomfortable part: the emails were fully authenticated.
How the attack worked
The attackers didn’t bother with crude spoofing. They went the long way round — and it paid off.
- Step 1: Emails sent through legitimate services, fully authenticated, from attacker-controlled domains
- Step 2: Display names like “Internal Regulatory COC”, “Workforce Communications” and “Team Conduct Report”, with subject lines like “Internal case log issued under conduct policy”
- Step 3: A polished, enterprise-style PDF attachment telling recipients to review their supposed case materials
- Step 4: Links from the PDF leading to attacker domains (acceptable-use-policy-calendly[.]de, compliance-protectionoutlook[.]de) gated by Cloudflare CAPTCHA — which conveniently kept automated security scanners and sandboxes out
- Step 5: Intermediate pages claiming the documents were “encrypted” and needed account authentication
- Step 6: A fake sign-in flow that proxied the real authentication session, capturing tokens in real time
That last step is the kicker. Microsoft noted this differs from traditional credential harvesting because AiTM attacks can bypass non-phishing-resistant MFA by intercepting authentication traffic live. Your MFA didn’t save you. The attacker was in the session with you.
Who got hit
The US absorbed 92% of the targets. By sector:
- Healthcare and life sciences — 19%
- Financial services — 18%
- Professional services — 11%
- Technology and software — 11%
The phishing waves ran from 06:51 UTC on 14 April to 03:54 UTC on 16 April. Two days, global reach.
The lesson the email industry keeps having to relearn
“Authenticated” and “trustworthy” are not the same thing.
SPF, DKIM and DMARC tell you whether a message is authorised by the sending domain. They do not tell you whether the sender has good intentions, whether the domain is legitimate, or whether the links in the message lead somewhere safe. In this campaign, the attackers used authenticated mail, credible-looking domains, legitimate delivery services and layered redirection to do exactly what good senders do — earn deliverability and earn trust.
Which means reputation signals beyond basic authentication are now essential:
- Domain age and history
- Sending patterns and infrastructure consistency
- PDF attachment behaviour
- Redirect chains
- CAPTCHA-gated destinations
- Post-delivery URL intelligence
When attackers are using the same trust cues legitimate senders rely on, alignment checks alone are not going to cut it.
What Microsoft recommends
- Review Exchange Online Protection and Microsoft Defender for Office 365 settings
- Enable Zero-hour auto purge
- Use Safe Links and Safe Attachments
- Investigate and purge any delivered phishing emails
- Strengthen privileged accounts with phishing-resistant MFA
- Move toward passwordless authentication — Windows Hello, FIDO keys — where possible
The bigger picture
Abuse prevention cannot stop at the alignment check. Authenticated mail is now part of the attacker’s toolkit, not a barrier against them. Sender reputation systems will increasingly need to account for behaviour, infrastructure and intent — not just whether a message passes the technical tests.
The campaign was over in 48 hours. The lesson should last considerably longer.
