How a Friendly Email Turns Into a Hijacked Microsoft 365 Account: A Five-Step Walkthrough
Researchers describe a phishing scheme that lets a victim sign in to the real Microsoft, MFA code and all, while the attacker quietly keeps the session. Here is how it unfolds.
Most people expect a phishing email to be clumsy and urgent. A campaign documented by Proofpoint researchers is neither. The group behind it, which they call TA419 and describe as China-aligned and espionage-motivated, went after experts in U.S. AI policy at think tanks, universities and law firms. The audience was narrow, but the playbook could be aimed at any business. Here is how it unfolds, one step at a time.
The five steps
- Borrow a trusted name. Beginning July 8, 2026, the attackers sent messages posing as a former White House science and technology policy official and later as a well-known economist and foreign-policy expert. Earlier in 2026, they had also posed as a senior employee of an AI company.
- Start with something harmless. The opening note contained nothing to click. It simply invited the recipient to join a fictitious “AI Policy Advisory Committee” or to contribute to a Senate committee report on AI export controls and supply chains.
- Wait for a reply. Only recipients who wrote back received the next message, which carried a shortened link supposedly offering more information. A response is what turns a stranger into a believable conversation partner.
- Show a fake file-sharing page. The link passed through a series of attacker-controlled websites, one of which screened visitors behind a fake OneDrive loading screen, and landed on a page that imitated a OneDrive folder. Clicking a document brought up what looked like a normal browser sign-in window, but it was only an overlay drawn inside the page.
- Pass the real login through a middleman. That window relayed the visitor’s sign-in to genuine Microsoft servers in real time. The password worked, the MFA code worked and any security checks passed, because Microsoft was actually answering. Meanwhile, the attackers collected the session cookies that prove the person is signed in. Their tooling even accepted the “Keep me signed in” prompt automatically to make the stolen session last longer.
The takeaway is that a correct password and a valid code do not prove you are talking to the real site. When the middleman is invisible, the usual defenses all appear to work.
What this means for your company’s inboxes
- Treat polite outreach as a possible first move. Proofpoint advises people who could be targeted to regard unsolicited, subject-matter invitations as a plausible setup, and to confirm them through a separate channel you choose, such as a phone number you look up yourself.
- Be as wary of a link after a reply as a link in a cold email. The same pattern could be dressed up as a vendor proposal, a board invitation or a prospective customer sharing a file.
- Look into phishing-resistant sign-in. The researchers recommend options such as passkeys, which are tied to the real website and so are much harder to relay. Ask your IT provider what is practical for your Microsoft 365 accounts.
Need help strengthening how your team signs in? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
This walkthrough is based on Proofpoint’s October 1 research report on TA419.
About The Author
