Beyond the Bait: Behavioral Sigma Detections for AiTM Phishing

Mon, 11 May 2026 10:00:00 +0000

Phishing campaigns are a moving target. The sender domain rotates every 48 hours. The PDF hash changes with each wave. The landing page infrastructure spins up on fresh hosting and disappears before anyone can block it. Chasing those indicators is necessary. It is also a treadmill.

Microsoft’s Defender Research team recently published a detailed analysis of a large-scale adversary-in-the-middle phishing campaign that targeted more than 35,000 users across 13,000 organizations using code of conduct lures, multi-stage CAPTCHA gating, and a polished AiTM session hijacking flow. The full technical breakdown is worth reading at the Microsoft Security Blog. Their detections – Anomalous Token alerts, Impossible Travel flags, and Defender for Office 365 URL click detections – are the right first line of response for Microsoft shops.

Phishing on Cyber Mixology

Beyond the Bait: Behavioral Sigma Detections for AiTM Phishing