How AITM-Based Phishing Campaigns Target Microsoft and Google Workspace Users

How AITM Phishing Campaigns Target Microsoft and Google Workspace Users

In recent years, AITM-based phishing campaigns (Attacker-in-the-Middle) have emerged as a powerful tool for threat actors, allowing them to target business users of platforms like Microsoft 365 and Google Workspace. These campaigns are designed to capture credentials and bypass security measures such as multi-factor authentication (MFA), posing a serious risk to business executives and senior employees, especially those at multinational organizations.

What Is an AITM Phishing Attack?

An AITM phishing attack uses a proxy server that sits between a legitimate website and a phishing site, capturing the user’s credentials, session cookies, and other sensitive information in real time. This setup allows the attacker to gain access to the user's account as if they were the legitimate user themselves.

In an AITM attack, the proxy server acts as a “middleman” that intercepts communication between the user and the target website. When the user enters their login credentials on the phishing page, they are actually submitting them to the attacker-controlled proxy, which then forwards them to the legitimate website, allowing the attacker to capture passwords and session cookies.

1. Credential Capture: Attackers can obtain passwords and use them to gain unauthorized access.
2. MFA Bypass: Because the attacker captures the session cookies, they can bypass MFA protections and continue to access accounts as if they were the legitimate user.

Recent Campaigns Targeting Microsoft and Google Workspace Users

A large-scale AITM campaign, uncovered by Zscaler researchers, has targeted business users of Microsoft 365 and Google Workspace, with a specific focus on senior executives and key employees. The campaign is notable for its intricate social engineering techniques and multi-step redirection paths designed to confuse traditional detection systems and convince victims to interact with the phishing site.

The attackers crafted emails that looked like legitimate notifications from Google or Microsoft, often citing issues like password expiration or account security alerts. For example, users received an email, supposedly from Google, reminding them that their password was about to expire, urging them to follow a link to update their credentials.

How the AITM Attack Works

The AITM attack chain involves several components working together to trap unsuspecting users:

1. Phishing Email: The initial email appears to come from a legitimate source, often urging the user to take immediate action on their account. Links within the email lead to a phishing site.
2. Multiple Redirects: The link in the phishing email is designed to pass through multiple routing points. This tactic can hide the destination URL, making it difficult for security filters to identify the link as malicious.
3. Target Verification Step: Once the user reaches the phishing site, the attackers verify whether they are a genuine user or an automated security system. This step prevents automated tools from detecting the phishing attempt prematurely.
4. Credential Capture via Proxy Server: When the user enters their credentials, they are submitted to the proxy server, which immediately forwards them to the legitimate website. The user remains unaware that their details are intercepted by an attacker.
5. Session Cookie Capture: Once the attacker captures the user’s session cookies, they can bypass MFA and access the account as if they were the legitimate user.

By capturing both the password and session cookies in real time, the attacker can maintain persistent access to the user’s account. Even if the user changes their password, the session remains active, enabling the attacker to continue operating undetected.

Why Executives and Senior Employees Are Primary Targets

Executives and senior employees have access to some of the most sensitive information within an organization. The attackers in these AITM campaigns have specifically crafted their phishing lures to target this group. Here's why:

• Access to Sensitive Data: Executives often have privileged access to company-wide information, making them valuable targets.
• Limited Time and High Trust: Executives may be more susceptible to well-crafted social engineering due to their busy schedules and the implicit trust placed in internal communications.
• Impact on Decision-Making: An attacker who gains access to an executive’s email can influence or intercept critical business decisions, posing a risk to the entire organization.

Protecting Against AITM Phishing Campaigns

Since AITM phishing attacks can bypass traditional security measures like MFA, it’s essential to implement additional security protocols. Here are some strategies that can help mitigate the risk:

1. Use Security Awareness Training

Security awareness training is essential for educating users, especially executives, about the latest phishing tactics. A comprehensive training program should include simulated phishing attacks, such as those provided by a Phishing Simulator, which can help employees recognize sophisticated threats and respond appropriately.

2. Implement Advanced Threat Detection Tools

Advanced tools like email threat simulators and incident responders are critical in detecting malicious links and phishing attempts that evade traditional filters. Organizations can leverage the Keepnet Human Risk Management Platform to deploy these tools and monitor user behavior, reducing the risk of successful attacks.

3. Strengthen Email Security Filters

Using advanced email security filters can help identify and block phishing emails before they reach users. For example, email incident response tools can help quickly respond to threats and identify compromised accounts before attackers gain full access.

4. Monitor for Suspicious Activity

Regular monitoring for unusual login locations, IP addresses, and login times can help detect when an account has been compromised. Real-time alerts and the use of multi-factor authentication (MFA) tokens are critical in identifying unauthorized access.

5. Encourage Use of Browser Isolation

Browser isolation tools prevent users from interacting with phishing sites by opening suspicious links in a secure environment. This reduces the likelihood of AITM attacks, as these tools prevent the proxy server from capturing user credentials and session data.

In an era of rapidly evolving phishing techniques, AITM phishing attacks represent a sophisticated and dangerous form of credential theft. As these campaigns continue to target business users on Microsoft 365 and Google Workspace, awareness and vigilance are essential. By implementing security awareness training, deploying advanced threat detection tools, and enforcing strict security protocols, organizations can reduce the risk of falling victim to these advanced phishing tactics.

Editor's Note: This blog was updated on November 18, 2024.