Microsoft’s threat intelligence team flagged something worth paying attention to. Between April 14 and 16, they observed more than 35,000 phishing attempts targeting roughly 13,000 organizations across 26 countries, with 92% of those targets based in the US. The emails didn’t look like typical spam. They looked like internal compliance notices.

Subject lines like ‘Reminder: employer opened a non-compliance case log’ and display names like ‘Internal Regulatory COC’ were designed to trigger urgency and compliance instincts. The goal wasn’t just to steal a password. It was to capture an authenticated session token, bypassing MFA entirely.

This campaign is a textbook example of adversary-in-the-middle (AitM) phishing, and it’s a reminder that standard multifactor authentication is no longer the finish line. Here’s what happened, why it worked, and what your organization should do about it.

Quick Answer In adversary-in-the-middle (AitM) phishing attacks, attackers proxy a victim’s login session in real time, capturing the authenticated session token rather than just the password. This bypasses SMS-based and push-notification MFA because the authentication step has already been completed by the time the attacker intercepts it. Defense requires phishing-resistant MFA (FIDO2/WebAuthn), Conditional Access policies, and active monitoring for token replay activity.

How the Attack Chain Worked

The campaign emails impersonated internal regulatory or compliance teams, directing recipients to open a PDF attachment labeled ‘Awareness Case Log File’ or ‘Disciplinary Action.’ Inside the PDF was a link to ‘Review Case Materials.’

Clicking that link sent victims through a Cloudflare CAPTCHA page, a gating mechanism designed to block automated security scanners, then to a page requesting their email address, then another CAPTCHA, and finally to what appeared to be a Microsoft sign-in page.

That last step was the attack. The sign-in page was attacker-controlled, proxying the real Microsoft authentication flow in real time. When the victim entered their credentials and completed MFA, the attacker captured the resulting session token, the proof-of-authentication that Microsoft’s systems accept for ongoing access. Password and MFA step: both bypassed.

Why Standard MFA Doesn’t Stop This

This is the part that catches organizations off guard. MFA is the right control; it stops the vast majority of credential-based attacks. But it has a known limitation: traditional MFA methods (SMS codes, authenticator app pushes, time-based one-time passwords) verify identity at the moment of login, not on an ongoing basis.

AitM attacks exploit the gap between authentication and session. Once the real Microsoft server issues a session token after a successful login, that token is the only thing needed for continued access and the attacker has it. There’s no second MFA prompt. The victim may not realize anything happened.

As Microsoft noted in their threat advisory, AitM attacks ‘intercept authentication traffic in real time, bypassing non-phishing-resistant multifactor authentication.’ The word ‘non-phishing-resistant’ is doing a lot of work in that sentence.

What Phishing-Resistant MFA Actually Means

Phishing-resistant MFA refers specifically to authentication methods that are cryptographically bound to the originating domain, meaning they can’t be replayed or proxied. FIDO2 security keys (like YubiKeys) and Microsoft Entra’s certificate-based authentication are the primary options in enterprise environments today.

These methods work differently at a technical level: the authentication credential includes a signed assertion that proves it was generated for a specific website origin. A proxy can’t replicate that. If the sign-in page isn’t the legitimate one, authentication fails, even if the victim never notices.

Upgrading to phishing-resistant MFA is the single highest-impact control against AitM attacks. It’s also one of the most common gaps in mid-market organizations that haven’t revisited their identity security posture since deploying standard MFA years ago.

A Layered Defense Is Still the Right Framework

Phishing-resistant MFA addresses the authentication bypass, but it’s one layer. A complete defense posture includes:

• Conditional Access policies that evaluate device compliance, sign-in risk, and location at every session, not just at initial login.
• Email security with link sandboxing and attachment detonation (Microsoft Defender for Office 365, Proofpoint, or equivalent) to flag the weaponized PDFs before they reach inboxes.
• Phishing awareness training that goes beyond ‘don’t click suspicious links’ to specifically address compliance-themed pretexting and multi-stage attack chains.
• SOC monitoring for anomalous token usage. Sign-ins from unexpected locations or devices shortly after a legitimate authentication event can indicate token replay.
• Zero trust architecture principles, which assume breach at every layer and require continuous verification rather than trusting a valid session indefinitely.

No single control stops a determined attacker. The combination does.

What This Means for IT Leaders Right Now

If your organization runs Microsoft 365 and hasn’t deployed phishing-resistant MFA, this campaign is a concrete reason to prioritize it. The industries most heavily targeted, healthcare, financial services, professional services, and technology, are exactly the segments where a single compromised account can escalate into a significant breach.

Start with a gap assessment: which user populations are still on SMS or push-based MFA? Which Conditional Access policies have exceptions that could be exploited? Where are session tokens being issued without device compliance checks? Those are the attack surfaces this campaign was built to exploit.

The threat intelligence and indicators of compromise (IoCs) from this campaign are publicly available through Microsoft’s Security Blog. If your team uses Microsoft Sentinel or Defender, the hunting queries Microsoft published are worth running now.

Frequently Asked Questions

What is an adversary-in-the-middle (AitM) phishing attack?

An adversary-in-the-middle (AitM) phishing attack is a technique where attackers insert a proxy server between the victim and a legitimate login page, typically Microsoft 365 or another cloud service. Instead of just stealing a password, the attacker intercepts the full authentication session in real time, capturing session tokens and MFA cookies. This allows them to bypass non-phishing-resistant multifactor authentication entirely and gain immediate account access without needing the victim’s credentials again.

Why does AitM phishing bypass standard MFA?

Standard MFA methods, including SMS codes, authenticator app push notifications, and time-based one-time passwords, verify identity at login but do not protect the session token issued after login. In an AitM attack, the attacker proxies the login in real time and captures the authenticated session token before the victim’s browser does. Once they have that token, MFA has already been passed. The only methods that fully prevent this are phishing-resistant MFA approaches like FIDO2/WebAuthn hardware keys or certificate-based authentication, which bind authentication to the originating domain and cannot be proxied.

What industries were targeted in Microsoft’s April 2026 phishing campaign warning?

According to Microsoft’s threat intelligence, the campaign most heavily targeted healthcare and life sciences, financial services, professional services, and technology and software companies. Of the roughly 13,000 organizations hit across 26 countries, 92% were based in the United States. The attack window was concentrated in a two-day span in mid-April 2026, with over 35,000 attempts observed.

How can organizations protect against AitM phishing attacks?

Defense against AitM phishing requires a layered approach. The most critical upgrade is deploying phishing-resistant MFA such as FIDO2 security keys or Microsoft Entra certificate-based authentication, which cannot be proxied. Beyond that, organizations should implement Conditional Access policies that evaluate device compliance and sign-in risk at every session, enable email security with link sandboxing, conduct regular phishing awareness training, and monitor for anomalous token usage through a SOC or SIEM platform.

How does Amplix help organizations defend against sophisticated phishing attacks?

Amplix brings together technology advisory expertise and cybersecurity services to help organizations identify gaps and deploy the right defenses. From evaluating phishing-resistant MFA solutions and zero trust architectures to managed security services and SOC-as-a-service engagements, Amplix acts as a trusted advisor across the full security stack. Reach out at amplix.com/contact to connect with our team.

Your MFA Upgrade Might Be Overdue. Let’s Find Out.

Most organizations deployed multifactor authentication years ago and haven’t revisited it since. If that describes you, this campaign is a good prompt to take stock. The question isn’t whether MFA is on; it’s whether the MFA you have can actually stop what attackers are doing now.

Amplix works with IT leaders and security teams to evaluate identity security posture, recommend phishing-resistant authentication approaches, and connect you with the right cybersecurity services for your environment. Contact Amplix to start the conversation.