CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Large-scale AiTM phishing campaign abuses code-of-conduct lures and CAPTCHA gates to harvest credentials

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A credential theft campaign spanning April 14–16, 2026, leveraged polished code-of-conduct-themed HTML phishing emails to trick recipients into visiting attacker-controlled domains and surrendering authentication tokens. The operation targeted more than 35,000 users across 13,000 organizations in 26 countries, with 92% of targets in the U.S. The emails impersonated internal communications about conduct reviews, incorporating fake authenticity statements, urgency cues, and PDF attachments pointing to CAPTCHA-gated phishing pages. Victims were ultimately routed through adversary-in-the-middle (AiTM) phishing infrastructure to harvest Microsoft credentials and session tokens in real time, effectively bypassing multi-factor authentication (MFA). The final landing experience varied based on whether the flow originated from mobile or desktop environments.

Timeline

  1. 05.05.2026 09:35 1 articles · 19h ago

    AiTM phishing campaign abuses code-of-conduct lures and CAPTCHA gates to harvest credentials

    A credential theft campaign spanning April 14–16, 2026, used enterprise-style phishing emails themed around code-of-conduct reviews to direct victims through CAPTCHA-gated pages to adversary-in-the-middle sign-in flows. The operation targeted 35,000+ users across 26 countries and harvested Microsoft credentials and tokens in real time, effectively bypassing MFA. The campaign employed PDF attachments, polished HTML lures with fake authenticity statements, and legitimate email delivery services to enhance credibility and evade detection.

    Show sources
    Open in new tab

Information Snippets