Security researchers warn that an ongoing cloud account takeover campaign has impacted dozens of Microsoft Azure environments owned by organizations from around the world. The attackers have compromised hundreds of accounts since late November 2023 including managers and senior executives.

“The varied selection of targeted roles indicates a practical strategy by threat actors, aiming to compromise accounts with various levels of access to valuable resources and responsibilities across organizational functions,” researchers from security firm Proofpoint said in their report.

The observed titles being targeted included sales director, account manager, finance manager, vice president of operations, chief financial officer, president, and CEO. Once an account is compromised the attackers add their own phone number or authenticator app as a multi-factor authentication (MFA) method to maintain persistence.

Campaigns use individualized phishing lures

According to Proofpoint, the selected users are targeted via the shared document functionality using phishing lures that are tailor-made for them and usually come from other compromised accounts within the same organization. The documents contain malicious links hidden behind instructions such as “view document” that redirect users to a phishing page that asks them to authenticate. While this technique is not particularly novel, the targeting and lateral movement employed by the attackers have increased the attack’s success rate, showing that relatively basic phishing methods are still efficient against many employees if the lure is good enough.

After compromising an account, the attackers take several steps to ensure they maintain access to it and are not discovered easily. In addition to adding their own MFA method to be able to pass MFA challenges in the future, the attackers create mailbox rules that are intended to hide their tracks and erase evidence of their malicious activity.

The ultimate goal of the attack seems to be financial fraud or business email compromise (BEC) with attackers sending emails from compromised accounts to employees in the human resources and financial departments. The attackers will also download sensitive files that contain information about financial assets, internal security protocols and user credentials to better prepare their fraud messages. Lateral movement is also a key component of the attack, with phishing emails being sent to other key employees in the organization from the compromised accounts.