Hijacked Outlook Inboxes Are Bypassing Your MFA

A finance employee at a university opens an email about a vendor procurement bid. She clicks through to a file sharing page, enters her Microsoft 365 password, and approves the MFA prompt on her phone, the same routine she's followed a thousand times. Thirty seconds later, an attacker sitting between her and Microsoft's login servers walks away with her live session cookie. Her mailbox becomes the next launchpad.

That's the mechanism behind a campaign detailed by threat intelligence firm Infoblox and reported by Cybersecurity News on July 22, 2026. It isn't a new vulnerability. It's an old technique, adversary in the middle (AiTM) phishing, running at a scale and with a level of institutional targeting that should worry any security team still treating MFA as a finished conversation.

Key Takeaways

• Infoblox documented a campaign, surfacing in May 2026, that uses reverse proxy kits EvilProxy, FlowerStorm (also tracked as Storm-1167), and Kali365 to hijack Microsoft 365 sessions.
• Attackers compromise an Outlook mailbox first, then reuse that trusted account to send procurement themed phishing lures to coworkers and external partners.
• Victims are routed through cloned Microsoft 365 login pages that relay credentials and MFA approvals to the real Microsoft service while the attacker captures the resulting session cookie.
• Targets include universities, enterprises, and multinational institutions, including bodies linked to the EU and UN.
• A related 2023 Proofpoint investigation found EvilProxy alone was used to target more than 100 organizations representing 1.5 million employees, with 39% of compromised accounts belonging to C-level executives.

How Does the Outlook Hijack Actually Work?

The attack starts with one compromised account, then spreads by abusing trust rather than exploiting new victims cold. According to the Cybersecurity News writeup, a single phishing email sent to a small group of employees was enough to trigger the initial breach. From there, attackers reuse the now compromised Outlook mailbox to resend the same procurement themed lures deeper into the victim's own network and out to external partners and vendors.

Victims clicking these internal looking emails are routed through fake file sharing pages impersonating services like OpenGov, ConstructConnect, and UN affiliated platforms. Those pages funnel to cloned Microsoft 365 sign in screens, sometimes branded to match the victim's own organization. Behind that fake login sits the actual phishing kit infrastructure. A hard requirement of the reverse proxy model, the same one Cyberpress described in its independent analysis of the campaign, is that the victim's credentials and MFA approval get passed through to the real Microsoft servers so the login actually succeeds. The attacker just sits in the middle, watching.

What Is AiTM Phishing, and Why Doesn't MFA Stop It?

AiTM phishing works by proxying a real authentication session instead of faking one. Traditional phishing kits show victims a static clone of a login page and simply harvest whatever username and password they type. That approach dies the moment MFA is enabled, because the attacker never sees the second factor. Reverse proxy kits fix that by sitting transparently between the victim and the legitimate service: every keystroke, MFA code, and approval tap gets forwarded in real time to Microsoft, and Microsoft's own session cookie comes back through the same channel, straight into the attacker's hands.

That cookie is the whole prize. It proves, as far as Microsoft's servers are concerned, that MFA already happened. Proofpoint's original research on EvilProxy found that at least 35% of compromised accounts in that 2023 campaign had additional account protections enabled, meaning MFA was on and it still didn't matter. FlowerStorm, the kit tracked in this Outlook campaign, evolved from an earlier phishing as a service platform called Rockstar2FA, according to Darktrace's analysis of the kit's infrastructure changeover, underscoring how quickly these toolkits get rebuilt and resold after takedowns.

Who Is Being Targeted, and What Happens After the Cookie Is Stolen?

This isn't opportunistic spray and pray phishing aimed at random consumers. The campaign specifically targets universities, enterprises, and multinational institutions, including organizations linked to the EU and UN, according to Infoblox's findings. Once an attacker has a live session, they gain the same visibility a legitimate logged in user would have: Outlook mail search, SharePoint document libraries, and any connected SaaS tools tied to the Microsoft 365 identity. Reported post compromise activity in adjacent AiTM campaigns includes payroll direct deposit redirection and searching mailboxes for finance and HR correspondence to fuel further business email compromise.

What Are the Warning Signs Security Teams Should Watch For?

The clearest signal isn't a malware signature, it's behavioral: sign ins that pass MFA cleanly but come from unfamiliar ASNs, followed almost immediately by mailbox rule changes or bulk outbound email. Infoblox's IOC list for this campaign includes newly registered domains built around business jargon (compliance, evaluation, procurement) sitting on shared hosting, plus a cluster of FlowerStorm infrastructure using .de domains with names like "consistenthostinghub" and "sustainablegrowthlaunch." None of that is exotic technically. It's disposable infrastructure designed to survive one or two campaign waves before rotating, which is exactly why passive DNS and newly observed domain monitoring catch it better than blocklists do.

Why Email Users Should Care

This campaign is a reminder that inbox compromise doesn't stay contained to one account. Once an attacker owns a mailbox, they inherit the sender reputation, the internal contact list, and the implicit trust that comes with an email arriving from a known coworker or vendor. That's a fundamentally different threat than a stranger's phishing email landing in a spam folder, and it's why a single successful AiTM login at a university procurement office can cascade into dozens of secondary compromises across departments and external partners.

It's also a reminder that inbox security spans more than credential theft. Gblock focuses on a narrower but related problem, stripping tracking pixels that let marketers, and in some cases less scrupulous actors, quietly log when and where an email gets opened. That's not the same threat as AiTM session hijacking, and no browser extension replaces phishing resistant authentication. But protecting what your inbox reveals about you, and hardening how your account gets accessed, are two halves of the same email privacy problem worth taking seriously together. For related coverage of phishing kits chasing the same MFA bypass, see Gblock's writeups on the DEBULL device code phishing kit and the Kratos phishing platform takedown.

How Should Security Teams Respond?

Session cookie theft renders password rotation alone useless, so the response has to target the authentication method and the session itself, not just the credential. CISA's phishing resistant MFA guidance recommends moving privileged and high risk accounts to FIDO2 security keys or passkeys, which can't be relayed through a reverse proxy the way a push notification or OTP code can. Beyond that:

• Enforce conditional access policies that flag or block sign ins from unfamiliar IP ranges or ASNs, even when MFA succeeds.
• Monitor Microsoft 365 sign in logs continuously for the pattern in this campaign: successful MFA followed quickly by mailbox rule changes or bulk send activity.
• Add passive DNS and newly registered domain monitoring to catch disposable AiTM infrastructure before it's reported publicly.
• Build rapid session token revocation into incident response, since killing the password after a cookie is already stolen accomplishes nothing.
• Treat any procurement, RFI, or bid related email that routes through a CAPTCHA gated file sharing page as high risk, especially when it originates from a normally trusted internal or partner mailbox.

Reverse proxy phishing kits keep getting cheaper, easier to rent, and harder to distinguish from a real login flow. The organizations getting hit here aren't careless, they're following an authentication model that assumed MFA was the finish line. This campaign is one more data point showing it's just the starting line for a different kind of attack.

Sources: Cybersecurity News, Cyberpress, Proofpoint, Darktrace, and CISA.