# CodeStorm AiTM Phishing Kit Abuses Compromised Microsoft 365 Accounts for Real-Time MFA-Bypass Account Takeover (Storm-1167 Overlap)

> CodeStorm is an adversary-in-the-middle (AiTM) phishing-as-a-service kit that abuses compromised Microsoft 365 mailboxes to send SPF/DKIM/DMARC-passing voicemail lures, funnels victims through Cloudflare Turnstile-gated fake Microsoft voicemail portals, and replays harvested credentials and MFA artifacts against Microsoft Entra ID in real time to hijack accounts. It overlaps (moderate confidence) with Microsoft-tracked Storm-1167 and has been active since at least January 2025.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0913
- **ID:** TL-2026-0913
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** CodeStorm operators
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CodeStorm is a previously undocumented adversary-in-the-middle (AiTM) phishing kit and operation that hijacks Microsoft 365 / Microsoft Entra ID accounts at scale. Initial access is achieved by abusing already-compromised M365 mailboxes — often those of known business partners with prior legitimate correspondence — to dispatch voicemail-notification lures that pass SPF, DKIM, and DMARC because they originate from authenticated sending infrastructure. The lures present a well-formatted Microsoft-branded message with a call duration, a reference ID, and an 'OPEN VOICEMAIL PORTAL' button. Secure email gateways are evaded through 'conversation stuffing' — a hidden whitespace block appending an unrelated dummy email thread — which also produces the tell-tale signature of From, To, and Return-Path headers all being identical.

The operation separates a rapidly rotating frontend (400+ apex domains, predominantly under the .de TLD, supporting roughly 12,000 subdomains) from a stable, tenant-aware backend controller exposed primarily at the path /google.php (alternate /next.php). Landing pages are gated by Cloudflare Turnstile, where the operator-supplied sitekey doubles as a per-operator identifier across distinct subdomains. Heavy client-side anti-analysis controls block developer tools and automation: checks for navigator.webdriver, window.callPhantom/_phantom, user-agent matching for 'Burp', suppression of F12/Ctrl+U/Ctrl+Shift+I and related shortcuts, right-click suppression, and a performance.now()-based debugger watchdog that redirects to legitimate Outlook on detection. A second-stage obfuscated JavaScript payload (bootstrap.min.js / bootstrappp.min.js) is delivered from Tencent Cloud Object Storage in the ap-seoul region (multiple recurring APPIDs) and begins with a base64-encoded operator harvester URL.

The backend's defining feature is a tenant-aware home-realm discovery matrix. A do=check action performs live home-realm discovery against Microsoft's real identity infrastructure, dynamically adapting the phishing flow based on whether the victim domain is a managed M365 tenant, a nonexistent user, a federated tenant, or a GoDaddy-managed account. A do=login action replays the submitted credentials against login.microsoftonline.com in real time — producing, within seconds, an OfficeHome Entra sign-in failure with error code 50126 (invalid username or password) in the victim tenant's logs, frequently from unexpected US geographies. A do=verify action triggers and intercepts MFA, with dedicated handlers for PhoneAppOTP (Authenticator OTP), PhoneAppNotification (push with number matching), and OneTimeCode (SMS/voice/email OTP), enabling theft and replay of the resulting session cookie. Post-compromise, the kit immediately creates an Outlook inbox rule (frequently named 'LinkedIn') that moves messages to 'RSS Feeds' and marks them read, then conducts SharePoint keyword reconnaissance and propagates onward phishing internally and to harvested contacts.

Hexastrike assesses with moderate confidence that CodeStorm overlaps with activity Microsoft tracks as Storm-1167, citing Tencent Cloud hosting reuse and Indonesian-language source-code artifacts (e.g., the helper parameter 'panjang', the error string 'Gagal memuat', the directory token 'ASLI') consistent with prior 2023 Microsoft reporting. The campaign has impacted 100+ confirmed tenants across roughly 600 targeted organizations, concentrated in North America and Western Europe across manufacturing, construction/real estate, healthcare/pharma, financial services, technology, government, and other sectors.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1550 Use Alternate Authentication Material
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1110 Brute Force
- T1087 Account Discovery
- T1534 Internal Spearphishing
- T1114 Email Collection
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1102 Web Service
- T1071 Application Layer Protocol

## Sources

- [Hackers Abuse Compromised Microsoft 365 Accounts to Launch CodeStorm Phishing Campaign](https://cybersecuritynews.com/hackers-abuse-compromised-m365-accounts/)
- [CodeStorm - A Microsoft 365 AiTM Phishing Kit with Storm-1167 Overlap](https://hexastrike.com/resources/blog/threat-intelligence/codestorm-a-microsoft-365-aitm-phishing-kit-with-storm-1167-overlap/)
- [CodeStorm Phishing Kit Uses Tenant-Aware M365 Replay to Hijack Microsoft 365 Accounts](https://cyberpress.org/codestorm-hijacks-m365-accounts/)
- [Phishing actors exploit complex routing and misconfigurations to spoof domains](https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/)
- [Storm-2372 conducts device code phishing campaign (related Microsoft 365 credential-theft tradecraft)](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0913