Hackers Bypass Microsoft 365 MFA With AiTM Phishing to Hijack Mailbox and Divert Vendor Payments

Cybercriminals bypassed Microsoft 365 multi-factor authentication (MFA) through an Adversary-in-the-Middle (AiTM) phishing attack, hijacked a finance employee’s active session, and used mailbox access to divert vendor payments to attacker-controlled bank accounts. The campaign was fully cloud-based, leaving no malware or endpoint compromise behind. The attack began with a targeted HR-themed email claiming that the recipient’s paid-time-off request had been denied. The message…