Microsoft Flags Multi-Stage Phishing Campaign Exploiting Code of Conduct Themes to Steal Tokens

GLOBAL, May 4, 2026, 16:23 UTC

Microsoft Defender Research has identified a widespread phishing campaign that uses a multi-stage attack chain centered around code of conduct-themed lures to compromise user credentials and authentication tokens.

The attackers exploited legitimate email services to send fully authenticated messages from domains under their control, increasing the trustworthiness of their phishing emails. This method allowed them to bypass common email security filters and deceive recipients into engaging with malicious content.

Central to the campaign is an adversary-in-the-middle (AiTM) technique that targets authentication tokens, enabling attackers to circumvent traditional multi-factor authentication protections and gain persistent access to compromised accounts.

Microsoft's analysis highlights that the campaign’s multi-step approach begins with carefully crafted emails referencing company policies and conduct guidelines, a tactic designed to prompt immediate attention and reduce suspicion among employees.

Once a user interacts with the phishing content, the attackers initiate token theft by intercepting authentication flows, effectively capturing session tokens that grant access without requiring password input.

This attack vector is particularly concerning because it undermines token-based security measures widely adopted by enterprises, including OAuth tokens used in cloud services and single sign-on systems.

Microsoft’s report underscores the sophistication of the campaign, noting the use of legitimate infrastructure and authenticated email channels, which complicates detection and response efforts.

Security teams are urged to review email authentication practices, including DMARC, DKIM, and SPF configurations, and to monitor for unusual token usage patterns that could indicate compromise.

Users should be cautious of unexpected emails referencing internal policies and avoid clicking links or downloading attachments without verification through separate channels.

The campaign’s scale and complexity suggest a well-resourced threat actor aiming to infiltrate organizations by exploiting trust in internal communications and the growing reliance on token-based authentication.

Microsoft continues to track the campaign and recommends organizations implement robust token monitoring, enforce conditional access policies, and educate employees on phishing indicators.

While no specific sectors were singled out, the attack’s reliance on corporate policy themes implies a focus on enterprise environments where such communications are routine.

The evolving nature of AiTM attacks signals a shift in attacker strategies, emphasizing the need for continuous adaptation of security controls beyond password protection.

Organizations should also consider deploying advanced threat detection tools capable of identifying anomalous authentication attempts and token misuse.

As this campaign unfolds, the risk of widespread credential theft and unauthorized access remains high, with potential impacts including data breaches and account takeovers.

Microsoft’s detailed advisory is available on their security blog, providing technical guidance and mitigation strategies for affected entities.

https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/