Multi-Stage 'Code of Conduct' Phishing Campaign Leads to AiTM Token Compromise (Microsoft Defender Research, April 2026)
Multi-Stage 'Code of Conduct' Phishing Campaign Leads to (TL-2026-0454), also tracked as Code of Conduct phishing campaign, is a high-severity phishing campaign, first published 2026-05-04. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID accounts, maps to 15 MITRE ATT&CK techniques (T1036, T1056, T1078), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0454
- Threat ID
- TL-2026-0454
- Also known as
- Code of Conduct phishing campaign, April 2026 AiTM token theft campaign
- Severity
- HIGH
- Status
- MONITORING
- Category
- PHISHING
- First published
- 2026-05-04
- Last reviewed
- 2026-05-04
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- healthcare, life-sciences, financial-services, professional-services, technology, software
- Target regions
- United States, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 22
Microsoft Defender Research disclosed a large-scale credential-theft campaign run April 14-16, 2026 that targeted 35,000 users across 13,000 organizations in 26 countries (92% United States). Operators impersonated internal compliance and HR functions with 'code of conduct review' lures and PDF attachments, walked victims through Cloudflare CAPTCHA gates and a platform-conditional redirect, and terminated in an adversary-in-the-middle (AiTM) Microsoft sign-in proxy that captured session tokens and bypassed non-phishing-resistant MFA. Healthcare, financial services, professional services, and technology firms were the most affected verticals.
How Multi-Stage 'Code of Conduct' Phishing Campaign Leads to works
Between 06:51 UTC on April 14, 2026 and 03:54 UTC on April 16, 2026, Microsoft Defender Experts and Microsoft Threat Intelligence observed a high-volume credential phishing campaign that combined social-engineering, anti-analysis tooling, and AiTM token theft. The operation targeted more than 35,000 users across 13,000+ tenants in 26 countries, with 92% of impacted users located in the United States. Healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%) made up the bulk of the victim pool.
Lures impersonated internal compliance, regulatory, or HR functions. Senders used display names such as 'Internal Regulatory COC', 'Workforce Communications', and 'Team Conduct Report', and subjects such as 'Internal case log issued under conduct policy' and 'Reminder: employer opened a non-compliance case log'. Each message carried a PDF attachment (e.g. 'Awareness Case Log File - Monday 13th, April 2026.pdf', 'Disciplinary Action - Employee Device Handling Case.pdf') containing a single hyperlink labeled 'Review & Sign'. Several lures were wrapped in a Paubox HIPAA-compliance banner to bait healthcare recipients with familiar branding.
When the victim clicked through, they were redirected to attacker-controlled infrastructure (e.g. compliance-protectionoutlook.de, acceptable-use-policy-calendly.de) fronted by a Cloudflare Turnstile / hCaptcha challenge. The CAPTCHA served as an execution guardrail: automated scanners and headless sandboxes were filtered out, leaving only real users to reach the next stage. A staging page then collected the victim's email address before issuing a second image-selection CAPTCHA. Server-side logic inspected the user agent and referrer to perform a platform-conditional redirect (mobile vs desktop) that delivered a tailored phishing template for each device class.
The terminal page rendered a pixel-perfect Microsoft sign-in dialog hosted on attacker infrastructure. When the victim authenticated, an AiTM reverse-proxy (consistent with Tycoon/Mamba-style phishing-as-a-service kits) brokered the session in real time with login.microsoftonline.com, captured the resulting session and refresh tokens, and bypassed any non-phishing-resistant second factor (SMS, voice call, push approval, or one-time password). Once tokens were exfiltrated, the operators had persistent access to the victim's Microsoft 365 environment as a valid cloud user, enabling downstream business email compromise, mailbox reconnaissance, and OAuth abuse.
Microsoft additionally observed the actors using cloud-hosted Windows VMs as legitimate sending infrastructure, abusing the reputation of mainstream cloud providers to evade SEG (secure email gateway) reputation filters. No nation-state attribution has been published; tradecraft is consistent with financially-motivated phishing-as-a-service crews operating commodity AiTM kits. Defender Research published the analysis on May 4, 2026.
Defenders should treat any recently-issued Microsoft session cookie obtained from a sign-in flow that did not use FIDO2 / Windows Hello / certificate-based authentication as suspect. Recommended mitigations include: enforcing phishing-resistant MFA via Conditional Access, enabling token-protection (CAE) where available, blocking the published domain and sender IOCs at the SEG and proxy, hashing the four PDF SHA-256 IOCs into AV/EDR blocklists, and proactively revoking refresh tokens on any account that interacted with the campaign.
MITRE ATT&CK techniques used in TL-2026-0454
Defense Evasion
T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion; T1684.001 Impersonation
Credential Access
T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Initial Access
T1078 Valid Accounts; T1566 Phishing
Discovery
T1082 System Information Discovery
Execution
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
Affected products and versions in Multi-Stage 'Code of Conduct' Phishing Campaign Leads to
- Microsoft — Microsoft 365 / Entra ID accounts
Vulnerable versions: Accounts using non-phishing-resistant MFA (SMS, voice call, push notification, TOTP/OTP, security questions)
Fixed in: Accounts protected by FIDO2 / WebAuthn / Windows Hello for Business / certificate-based authentication with token-protection enforced via Conditional Access - Cloudflare — Turnstile / managed CAPTCHA (abused as execution guardrail, not vulnerable)
Remediation for Multi-Stage 'Code of Conduct' Phishing Campaign Leads to
Immediate actions
- Block all six attacker domains at egress proxy, SEG, and DNS layers (compliance-protectionoutlook.de, acceptable-use-policy-calendly.de, cocinternal.com, gadellinet.com, harteprn.com, na.businesshellosign.de)
- Block the five sender addresses at the SEG and quarantine any prior delivery in the last 21 days
- Add the four PDF SHA-256 hashes (5DB1EC..., B5A334..., 11420D..., and any sibling of the same template) to AV/EDR blocklists and Microsoft Defender XDR custom indicators
- Run a retro-hunt across mailbox audit logs for inbound messages with subjects matching 'code of conduct', 'conduct policy', 'non-compliance case log', or 'awareness case log'
- Hunt Entra ID sign-in logs for impossible-travel, unfamiliar IP, or non-compliant device sign-ins between 2026-04-14 and 2026-04-17 and revoke refresh tokens for matched users
Workarounds
- Temporarily require step-up authentication (re-auth) for all Microsoft 365 sign-ins originating from non-compliant or unfamiliar devices
- Disable legacy authentication protocols (POP, IMAP, SMTP AUTH, EWS basic) that AiTM operators pivot to with stolen tokens
- Bulk-revoke refresh tokens (Revoke-AzureADUserAllRefreshToken / equivalent Microsoft Graph call) for any user who clicked a campaign link
Longer-term hardening
- Migrate all privileged and high-risk users to phishing-resistant MFA (FIDO2 security keys, Windows Hello for Business, certificate-based authentication)
- Enforce Conditional Access policies that require compliant device + phishing-resistant authentication for Microsoft 365 and Entra-protected SaaS
- Enable Continuous Access Evaluation (CAE) and token-protection for sign-in sessions to invalidate stolen tokens when device or location signals change
- Configure Microsoft Defender for Office 365 Safe Links with real-time URL detonation and impersonation protection for executive and HR mailboxes
- Publish strict DMARC (p=reject) and enforce SPF/DKIM alignment; tighten lookalike-domain monitoring on .de, .com, and brand variants
Weaknesses (CWE) in Multi-Stage 'Code of Conduct' Phishing Campaign Leads to
CWE-294, CWE-300, CWE-451, CWE-1021
Timeline of Multi-Stage 'Code of Conduct' Phishing Campaign Leads to
- Earliest PDF lure observed (Awareness Case Log File - Monday 13th, April 2026.pdf) staged for distribution; attacker domains and sender mailboxes pre-positioned
- First confirmed campaign waves launched at 06:51 UTC; phishing emails impersonating internal compliance/COC functions delivered to 13,000+ Microsoft 365 tenants
- Peak send volume; multiple themed PDFs ('Awareness Case Log File', 'Disciplinary Action - Employee Device Handling Case') and platform-conditional redirect logic observed by Defender Experts
- Microsoft Defender XDR telemetry consolidated; healthcare (19%), financial services (18%), professional services (11%), and technology (11%) identified as top-targeted verticals
- Last observed activity at 03:54 UTC; total telemetry: 35,000 users / 13,000 organizations / 26 countries (92% United States)
- Threadlinqs Intelligence publishes TL-2026-0454 with D1-aligned threat record, MITRE mappings, IOCs, detections, and simulation refs
- Microsoft Security Blog publishes 'Breaking the code: Multi-stage code of conduct phishing campaign leads to AiTM token compromise' with full IOCs, tradecraft, and recommended mitigations
- As of 2026-05-29, the specific 3-day "code of conduct" AiTM campaign (Apr 14-16) went quiet with no new waves, but its operator is unattributed and undisrupted. The underlying AiTM/PhaaS technique (Tycoon2FA/Mamba-style) stays a live concern—rebounding to pre-takedown volumes within weeks of the Mar 2026 seizure—so contained-but-resurgeable.
Sources cited for Multi-Stage 'Code of Conduct' Phishing Campaign Leads to
- Breaking the code: Multi-stage 'code of conduct' phishing campaign leads to AiTM token compromise
- From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud
- CISA - Implementing Phishing-Resistant MFA
- MITRE ATT&CK T1557 - Adversary-in-the-Middle
- MITRE ATT&CK T1539 - Steal Web Session Cookie
- NIST SP 800-63B - Digital Identity Guidelines (Authenticator Assurance Levels)
- Microsoft - Conditional Access token protection (preview)
Threats related to Multi-Stage 'Code of Conduct' Phishing Campaign Leads to
- input_24 AiTM Phishing Kit Harvesting AWS Console Credentials and Real-Time MFA Codes
- Nested Triple-Chain Google Domain Phishing — Microsoft SafeLinks -> meet.google.com/linkredirect -> google.com/url -> adservice.google.com.ph Evades SEGs and Lands M365 Credential Theft Plus OAuth 2.0 Device-Code Phishing (KnowBe4 ThreatLabs Nested Delivery Matrix)
- Winter Olympics 2026 Domain Impersonation and Phishing Infrastructure Campaign
Detection coverage for TL-2026-0454
As of 2026-05-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0454 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.