Microsoft has disclosed details of a large-scale credential theft campaign that used code of conduct-themed lures, polished corporate-style emails, PDF attachments, CAPTCHA pages, and adversary-in-the-middle phishing to steal Microsoft authentication tokens.
The campaign was observed between April 14 and April 16, 2026, and targeted more than 35,000 users across over 13,000 organizations in 26 countries. Microsoft reported that 92% of targets were in the United States, with healthcare and life sciences, financial services, professional services, and technology/software among the most affected sectors.
The Lure: Fake Code of Conduct Reviews
The phishing emails were designed to look like serious internal HR or compliance communications.
Attackers used display names such as:
- Internal Regulatory COC
- Workforce Communications
- Team Conduct Report
The subject lines were crafted to create anxiety and urgency, including themes such as an internal case log, employer non-compliance case, or conduct policy review. Microsoft said the emails used polished enterprise-style HTML templates with structured layouts and “authenticity” statements claiming the message had been issued through an authorized internal channel.
This is effective social engineering. A code of conduct review sounds personal, urgent, and potentially career-impacting. That pressure can make users click before they think.
PDF Attachment Used as the Next Step
The emails included a PDF attachment that supposedly contained additional details about the conduct review.
Inside the PDF, victims were encouraged to click a link to continue the review process. From there, the attack chain routed users through multiple intermediate pages and CAPTCHA checks before reaching the final phishing page. Microsoft noted that this multi-stage structure helped the campaign appear more legitimate while also making automated analysis harder.
In simple terms, the flow looked like this:
Phishing email
↓
Code of conduct / compliance lure
↓
PDF attachment
↓
Link inside PDF
↓
CAPTCHA and redirect pages
↓
Fake Microsoft sign-in page
↓
Credential and token theft
AiTM Phishing: Bypassing MFA
The final stage used adversary-in-the-middle phishing, often called AiTM phishing.
Unlike basic phishing pages that only steal usernames and passwords, AiTM phishing proxies the login process in real time. This allows attackers to capture session tokens after the victim completes authentication, potentially bypassing multifactor authentication.
That means MFA remains essential, but it is not enough on its own. If a user completes an AiTM login flow, the attacker may receive a valid session token and access the account without needing the user’s MFA device again.
Why This Campaign Stands Out
This campaign is notable for several reasons:
- 📧 It used legitimate email delivery services to increase trust.
- 🧾 It used workplace compliance and code of conduct themes to create pressure.
- 📎 It moved the malicious link into a PDF attachment.
- 🧩 It used CAPTCHA and redirect pages to evade automation.
- 🔐 It used AiTM phishing to steal tokens and bypass MFA.
- 🏢 It targeted thousands of organizations across many sectors.
Microsoft’s reporting shows that phishing campaigns are becoming more polished, more layered, and more identity-focused.
Phishing Trends in 2026
This campaign is part of a broader shift in the email threat landscape.
Microsoft reported that in Q1 2026, it detected approximately 8.3 billion email-based phishing threats. Nearly 80% of those threats were link-based, showing how attackers increasingly prefer redirect chains, hosted phishing pages, QR codes, HTML files, PDFs, and cloud-based lures over traditional malware attachments.
Microsoft also found that QR code phishing became the fastest-growing phishing vector in Q1 2026, increasing from 7.6 million attacks in January to 18.7 million in March, a 146% increase.
This matters because QR codes often push users onto mobile devices, where corporate security controls may be weaker than on managed desktops.
CAPTCHA-Gated Phishing Is Growing
CAPTCHA-gated phishing also evolved rapidly in Q1 2026.
Attackers use CAPTCHA pages to make the phishing flow look legitimate and to filter out automated scanners, sandboxes, and security crawlers. Once the user passes the CAPTCHA, they are redirected to the real credential-harvesting page. Microsoft reported that CAPTCHA-gated phishing expanded across multiple delivery methods and payload types during the quarter.
This is important because users often associate CAPTCHA prompts with trusted websites. Attackers are abusing that trust.
Phishing-as-a-Service Keeps Adapting
Microsoft also reported continued activity from phishing-as-a-service platforms such as Tycoon 2FA, Kratos, and EvilTokens. After a coordinated disruption operation in March 2026, Tycoon 2FA activity shifted hosting providers and domain registration patterns, suggesting the operators were trying to replace infrastructure and anti-analysis protections.
This shows how quickly phishing ecosystems adapt. Taking down one set of domains or hosting providers may slow activity, but successful criminal platforms often reappear with new infrastructure.
Abuse of Legitimate Services
Another worrying trend is the abuse of legitimate services.
Kaspersky reported that attackers have been abusing Amazon Simple Email Service as a phishing delivery vector, often by using leaked AWS access keys. Because the emails originate from trusted infrastructure and may pass SPF, DKIM, and DMARC checks, they can appear more legitimate to both users and security tools.
This reflects a broader challenge: phishing no longer always comes from obviously suspicious domains. Attackers increasingly hide behind trusted platforms, cloud services, file-sharing tools, and legitimate email infrastructure.
Defensive Recommendations
Organizations should treat this campaign as an identity-security warning.
Recommended actions include:
- ✅ enforce phishing-resistant MFA where possible, such as FIDO2/security keys
- ✅ monitor for AiTM indicators and suspicious session token use
- ✅ alert on impossible travel, new device sign-ins, and unusual session activity
- ✅ block or inspect suspicious PDF links and redirect chains
- ✅ train users on HR, compliance, and code of conduct lures
- ✅ warn users that CAPTCHA does not mean a site is safe
- ✅ review email authentication, but do not rely on SPF/DKIM/DMARC alone
- ✅ restrict risky OAuth consent and monitor new app grants
- ✅ use Conditional Access based on device compliance, location, and risk
- ✅ make phishing reporting simple and fast for employees
Security teams should also investigate suspicious sign-ins immediately after reported phishing attempts, because token compromise can happen quickly.
User Awareness Message
A simple internal warning could be:
🚨 Be cautious of unexpected code of conduct, HR, compliance, or internal investigation emails. Do not open attached PDFs or sign in through links unless you can verify the request through a trusted internal channel.
The key rule is simple: pressure is a red flag.
If an email creates fear, urgency, or embarrassment, slow down and verify.
Final Thoughts
This campaign shows how modern phishing is moving beyond obvious fake emails.
Attackers are combining polished templates, legitimate delivery services, PDFs, CAPTCHA pages, redirect chains, and AiTM phishing to steal authentication tokens and bypass MFA.
🔐 The target is no longer just the password. The target is the session.
Organizations need to defend identity systems as aggressively as they defend endpoints and networks. MFA is still essential, but modern phishing requires stronger controls: phishing-resistant authentication, Conditional Access, token monitoring, user education, and rapid response.
