CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365 Accounts for Real-Time MFA-Bypass Account Takeover (Storm-1167 Overlap)
CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365 (TL-2026-0913), also tracked as CodeStorm, is a high-severity phishing campaign, first published 2026-06-23. It is attributed to CodeStorm operators with medium confidence, affects Microsoft Microsoft 365, maps to 22 MITRE ATT&CK techniques (T1027, T1056, T1071), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0913
- Threat ID
- TL-2026-0913
- Also known as
- CodeStorm, CodeStorm AiTM Phishing Kit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution
- CodeStorm operators
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, construction, real estate, healthcare, pharmaceutical, financial services, technology, telecom, government, retail, energy, legal
- Target regions
- North America, Western Europe, Asia-Pacific, Africa, South America, Australia
- Detection rules
- 9
- Indicators of compromise
- 32
CodeStorm is an adversary-in-the-middle (AiTM) phishing-as-a-service kit that abuses compromised Microsoft 365 mailboxes to send SPF/DKIM/DMARC-passing voicemail lures, funnels victims through Cloudflare Turnstile-gated fake Microsoft voicemail portals, and replays harvested credentials and MFA artifacts against Microsoft Entra ID in real time to hijack accounts. It overlaps (moderate confidence) with Microsoft-tracked Storm-1167 and has been active since at least January 2025.
How CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365 works
CodeStorm is a previously undocumented adversary-in-the-middle (AiTM) phishing kit and operation that hijacks Microsoft 365 / Microsoft Entra ID accounts at scale. Initial access is achieved by abusing already-compromised M365 mailboxes — often those of known business partners with prior legitimate correspondence — to dispatch voicemail-notification lures that pass SPF, DKIM, and DMARC because they originate from authenticated sending infrastructure. The lures present a well-formatted Microsoft-branded message with a call duration, a reference ID, and an 'OPEN VOICEMAIL PORTAL' button. Secure email gateways are evaded through 'conversation stuffing' — a hidden whitespace block appending an unrelated dummy email thread — which also produces the tell-tale signature of From, To, and Return-Path headers all being identical.
The operation separates a rapidly rotating frontend (400+ apex domains, predominantly under the .de TLD, supporting roughly 12,000 subdomains) from a stable, tenant-aware backend controller exposed primarily at the path /google.php (alternate /next.php). Landing pages are gated by Cloudflare Turnstile, where the operator-supplied sitekey doubles as a per-operator identifier across distinct subdomains. Heavy client-side anti-analysis controls block developer tools and automation: checks for navigator.webdriver, window.callPhantom/_phantom, user-agent matching for 'Burp', suppression of F12/Ctrl+U/Ctrl+Shift+I and related shortcuts, right-click suppression, and a performance.now()-based debugger watchdog that redirects to legitimate Outlook on detection. A second-stage obfuscated JavaScript payload (bootstrap.min.js / bootstrappp.min.js) is delivered from Tencent Cloud Object Storage in the ap-seoul region (multiple recurring APPIDs) and begins with a base64-encoded operator harvester URL.
The backend's defining feature is a tenant-aware home-realm discovery matrix. A do=check action performs live home-realm discovery against Microsoft's real identity infrastructure, dynamically adapting the phishing flow based on whether the victim domain is a managed M365 tenant, a nonexistent user, a federated tenant, or a GoDaddy-managed account. A do=login action replays the submitted credentials against login.microsoftonline.com in real time — producing, within seconds, an OfficeHome Entra sign-in failure with error code 50126 (invalid username or password) in the victim tenant's logs, frequently from unexpected US geographies. A do=verify action triggers and intercepts MFA, with dedicated handlers for PhoneAppOTP (Authenticator OTP), PhoneAppNotification (push with number matching), and OneTimeCode (SMS/voice/email OTP), enabling theft and replay of the resulting session cookie. Post-compromise, the kit immediately creates an Outlook inbox rule (frequently named 'LinkedIn') that moves messages to 'RSS Feeds' and marks them read, then conducts SharePoint keyword reconnaissance and propagates onward phishing internally and to harvested contacts.
Hexastrike assesses with moderate confidence that CodeStorm overlaps with activity Microsoft tracks as Storm-1167, citing Tencent Cloud hosting reuse and Indonesian-language source-code artifacts (e.g., the helper parameter 'panjang', the error string 'Gagal memuat', the directory token 'ASLI') consistent with prior 2023 Microsoft reporting. The campaign has impacted 100+ confirmed tenants across roughly 600 targeted organizations, concentrated in North America and Western Europe across manufacturing, construction/real estate, healthcare/pharma, financial services, technology, government, and other sectors.
MITRE ATT&CK techniques used in TL-2026-0913
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading
Credential Access
T1056 Input Capture; T1110 Brute Force; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Persistence
T1078 Valid Accounts; T1098 Account Manipulation
Discovery
Collection
T1114 Email Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Lateral Movement
lateral-movement
T1550 Use Alternate Authentication Material
Initial Access
Resource Development
Affected products and versions in CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365
- Microsoft — Microsoft 365
Vulnerable versions: all tenants without phishing-resistant MFA / strict Conditional Access - Microsoft — Microsoft Entra ID
Vulnerable versions: tenants permitting OTP/push/SMS MFA without token protection - Microsoft — Outlook / Exchange Online
Vulnerable versions: mailboxes reachable via compromised credentials
Remediation for CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365
Immediate actions
- Block the documented CodeStorm apex/sub domains and harvester paths (/google.php, /next.php) at the secure web gateway and DNS layer
- Block the documented email-origin and Entra replay IPs (e.g. 104.161.48.103, 98.183.80.18) and revoke active sessions/tokens for any user showing OfficeHome error 50126 from unexpected geographies
- Hunt Entra sign-in logs for OfficeHome failures with error code 50126 clustered within seconds of phishing-click events and from unfamiliar ASNs/hosting providers (e.g. Tencent ASN)
- Search Unified Audit Log for New-InboxRule/Set-InboxRule events (especially a 'LinkedIn' rule routing to 'RSS Feeds') created shortly after anomalous sign-ins
Workarounds
- Apply Microsoft Conditional Access authentication strengths to mandate phishing-resistant methods
- Tune secure email gateways to flag messages where From, To, and Return-Path headers are identical and to detect hidden-whitespace dummy-thread (conversation stuffing) padding
Longer-term hardening
- Deploy phishing-resistant, FIDO2-based authentication (security keys, Windows Hello for Business, passkeys, certificate-based auth) and remove SMS/voice/email OTP and push-approval fallbacks for sensitive apps
- Enforce Conditional Access combining user risk, sign-in risk, device compliance, location, and application sensitivity; require compliant/managed devices for sensitive applications
- Enable Continuous Access Evaluation and Token Protection where supported to limit stolen-session-cookie replay
Weaknesses (CWE) in CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365
CWE-1021, CWE-290, CWE-294
Timeline of CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365
- Earliest observed CodeStorm activity; start of the 16-month incident-response telemetry window (per Hexastrike).
- Microsoft publishes analysis of Storm-2372 device-code phishing — related Microsoft 365 credential-theft tradecraft contemporaneous with CodeStorm's early operations.
- Microsoft documents phishing actors abusing complex mail routing and misconfigurations to spoof domains, contextualizing CodeStorm's SPF/DKIM/DMARC-passing compromised-mailbox delivery.
- End of the January 2025-April 2026 IR telemetry collection period spanning 100+ confirmed tenant compromises and ~600 targeted organizations.
- Disclosure to affected customers of CodeStorm AiTM account takeovers.
- Abuse notifications sent to Cloudflare (Turnstile) and Tencent Cloud (COS payload hosting).
- Microsoft Security Response Center (MSRC) notified of the campaign and Storm-1167 overlap.
- Public technical disclosure of the CodeStorm phishing kit and Storm-1167 attribution overlap (Hexastrike).
- Follow-on news coverage details CodeStorm's tenant-aware M365 replay and Microsoft 365 account-hijack mechanics (Cyber Press).
- Follow-on public reporting detailing compromised-M365-account abuse, voicemail lures, Turnstile gating, and Entra error 50126 replay signal.
Sources cited for CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365
- Hackers Abuse Compromised Microsoft 365 Accounts to Launch CodeStorm Phishing Campaign
- CodeStorm - A Microsoft 365 AiTM Phishing Kit with Storm-1167 Overlap
- CodeStorm Phishing Kit Uses Tenant-Aware M365 Replay to Hijack Microsoft 365 Accounts
- Phishing actors exploit complex routing and misconfigurations to spoof domains
- Storm-2372 conducts device code phishing campaign (related Microsoft 365 credential-theft tradecraft)
Threats related to CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365
- AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM Session Theft
- International Law Enforcement Dismantles Kratos (SneakyLog/Sneaky 2FA) Phishing-as-a-Service Platform Behind 15,000 Monthly Microsoft 365 Credential-Harvesting Campaigns
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys
- Tycoon2FA Phishing-as-a-Service Platform Persists Post-Europol Takedown with Rapid Infrastructure Recovery
- UNC6671 Rebrands BlackFile into Redact, Pink, Helix, Falcon: Vishing + AiTM Campaign Steals M365/Okta Data for Extortion
- W3LL Phishing-as-a-Service Ecosystem Dismantled — FBI/Indonesia Takedown of $20M BEC Platform
Detection coverage for TL-2026-0913
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0913 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.