A construction/landscaping firm’s executive email account was compromised and used to send convincing “request for proposal” (RFP) emails to another company, tricking recipients into entering Microsoft 365 credentials and an MFA code on a fake login page. The attackers used a man-in-the-middle workflow so Microsoft sent the real SMS code, which the victim then unknowingly handed over via the phishing site. In a separate case, a small construction company that declined security help was later hit by ransomware and shut down within months after backups were also encrypted.
Attackers first compromised the email account of an executive at a construction/landscaping firm. From that trusted mailbox, they sent phishing emails to a partner company framed as RFPs, requests for proposal. Instead of an attached document, the email included a download button. Clicking it led recipients to a page that looked identical to the real Microsoft 365 login screen but was hosted on a domain other than microsoft.com.
Because the targeted user had two-factor authentication enabled, the fake page also asked for a limited-time 2FA code. The attackers relayed the stolen username and password to Microsoft's real login system in real time, which triggered a genuine SMS code to be sent to the victim. The victim then typed that real code into the fake page, handing the attackers everything needed to complete a man-in-the-middle session takeover.
The lure worked because it came from a real, known contact rather than a stranger. An RFP is an attractive, plausible reason for a partner company to reach out, and recipients who had interacted with the sender before had little reason to be suspicious. The attackers also created email filtering rules inside the compromised executive's mailbox to hide outgoing campaign messages, reducing the chance the real user would notice the abuse of their own account.
Detection tooling in this case identified the anomalous login and revoked the session token within minutes, which limited how long the attackers could operate. Organizations can reduce the risk of similar incidents by treating unsolicited business requests as higher risk and verifying them through a separate known contact channel before clicking any link. Checking the web address before entering any credentials is a simple but effective habit. Because one-time SMS codes can be relayed by attackers in real time, moving high-value users to phishing-resistant MFA such as hardware security keys or passkeys closes off this specific man-in-the-middle technique entirely, since there is no code for an attacker to intercept and reuse.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers compromised an executive's email account and sent RFP-themed phishing emails to a partner company. Clicking a download button led victims to a fake Microsoft 365 login page not hosted on the microsoft.com domain, where they entered their credentials and a 2FA code.
The fake login page relayed the stolen credentials to the real Microsoft site in real time, prompting Microsoft to send a genuine SMS code. The victim entered that code on the phishing page, completing a man-in-the-middle takeover.
The email came from a real, previously compromised executive mailbox and was framed as a legitimate RFP (request for proposal), a lure designed to look like a genuine new business opportunity from a known contact.
Awareness takeaways include verifying unexpected RFP or quote requests through a separate known contact method, checking login page domains before entering credentials, and moving to phishing-resistant MFA such as hardware keys or passkeys.
An exec’s real email gets hacked, then used to send you a shiny new RFP. Looks like easy new business, right? You click the download button and land on a perfect-looking Microsoft 365 login page that even asks for your limited-time SMS code. But the web address is not microsoft.com. Here’s the trick: this is a man-in-the-middle. When you type your password and SMS code, they relay it to Microsoft in real time and walk straight into your M365 account as you. If an RFP or quote email makes you click a link and log in, stop and call your known contact to confirm before you touch that download button.
Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox…
Cisco Talos Incident Response reports that phishing drove initial access in over half of Q2 2026 cases, often using QR codes in PDF attachments and trusted cloud hosting to evade email defenses. Attackers frequently bypassed multi-factor authentication using adversary-in-the-middle proxies,…
Nikkei said an attacker took over an employee’s Microsoft 365 email account and used it to send about 9,000 phishing emails to people who had previously communicated with Nikkei staff, including journalistic sources. The messages contained links leading to malicious websites, creating a high-trust…
Proofpoint linked China-nexus actor TA419 to credential-phishing campaigns aimed at U.S. AI policy experts, including people at think tanks. The attacker impersonated well-known AI policymakers and an Anthropic executive, using believable “advisory committee” and “research questions” emails to draw…
Proofpoint reports a China-aligned espionage group (TA419) targeted U.S. AI policy experts at think tanks, universities, and law firms using phishing emails that impersonated well-known officials and AI industry figures. The attackers tried to start a conversation first, then sent a shortened link…
Microsoft disrupted EvilTokens, a phishing-as-a-service operation linked to thousands of compromised Microsoft 365 inboxes. The group used “device code” phishing to steal valid session tokens (not passwords) and then used an AI chatbot to scan mailboxes and help craft business email compromise…
