Threat actors are using the EvilProxy phishing platform to bypass multifactor authentication (MFA) protections in the Microsoft 365 accounts belonging to high-level corporate executives at prominent firms.

According to a new Proofpoint research, since March 2023, an ongoing hybrid EvilProxy campaign combining brand impersonation, bot detection evasion, and open redirections has targeted thousands of Microsoft 365 user accounts, with approximately 120,000 phishing emails sent to hundreds of targeted organizations across the globe between March and June 2023.

EvilProxy is an adversary-in-the-middle attack platform that allows cybercriminals to create customized phishing emails that include links to fake phishing websites that look like legitimate sign-in pages for services like Google Workspace and Microsoft 365. These phishing sites redirect traffic from users to legitimate login portals allowing a threat actor to capture user credentials and valid session cookies, using which the attacker can continually log in to services without the need to re-authenticate.

Proofpoint said that over the past six months, it observed a substantial rise of over 100% in successful cloud account takeover incidents impacting high-level executives, with more than 100 companies targeted globally.

According to the researchers, at least 35% of the compromised accounts had MFA enabled. More than one-third of the accounts belonged to C-level executives, including CEOs and chief financial officers.

The campaign involved the use of several techniques:

Brand impersonation. Sender addresses impersonated trusted services and apps, such as Concur Solutions, DocuSign and Adobe.

Scan blocking. Attackers utilized protection against cyber security scanning bots, making it harder for security solutions to analyze their malicious web pages.

Multi-step infection chain. Attackers redirected traffic via open legitimate redirectors, including YouTube, followed by additional steps, such as malicious cookies and 404 redirects.

“Given access to a “VIP” user account, attackers will first seek to consolidate their gains by establishing persistence. Then, they will attempt to exploit their unauthorized access,” the researchers wrote. “During those last phases, cyber criminals employ various techniques, including lateral movement and malware proliferation. The attackers have been known to study their target organizations’ culture, hierarchy, and processes, to prepare their attacks and improve success rates. In order to monetize their access, attackers were seen executing financial fraud, performing data exfiltration or partaking in Hacking-as-a-Service (HaaS) transactions, selling access to compromised user accounts.”