The Procurement Trap: How Microsoft 365 Session Hijacking Campaigns Bypass MFA Using Compromised Outlook Mailboxes

What Is "The Procurement Trap" Campaign?

On July 22, 2026, Infoblox Threat Intelligence published a detailed report on an ongoing global adversary-in-the-middle (AiTM) phishing campaign it calls "The Procurement Trap." The campaign uses procurement-themed email lures—such as fake request-for-information (RFI) documents, bid invitations, and project files—sent from previously compromised Outlook mailboxes . When recipients click these links, they land on reverse-proxy phishing pages that capture live Microsoft 365 session cookies immediately after the victim authenticates, completely bypassing multi-factor authentication (MFA) .

Key characteristics of the campaign:

• Attack vector: Attackers compromise legitimate small-business websites and Outlook accounts to host and distribute phishing links, routing attacks through infrastructure that appears trustworthy .
• Targets: The campaign explicitly targets universities, enterprises, and multinational institutions, including European Union and United Nations agencies .
• Multiple AiTM kits in use: The threat actors rotate between several phishing-as-a-service (PhaaS) toolkits:
  • EvilProxy – a PhaaS toolkit that intercepts session cookies to bypass SMS codes, authenticator apps, and push notifications .
  • FlowerStorm – a widely active PhaaS operation that recently adopted browser-based virtual-machine obfuscation to evade email defenses .
  • Kali365 – a PhaaS platform first seen in April 2026, distributed via Telegram, that uses device code phishing to capture session tokens without needing passwords or MFA codes at all .
• Bulk registered algorithmic domains (RDGAs) are used to create a high volume of phishing URLs that rotate rapidly, making blocklisting difficult .

How the Attack Works (Technical Mechanism)

The attacker sets up an intermediate phishing site that acts as a live reverse proxy between the victim and legitimate Microsoft 365 authentication services . When a victim enters credentials and completes MFA, the proxy captures the resulting session cookie before it reaches the victim's browser. The attacker then imports that cookie into their own browser and gains full access to the victim's Exchange Online, SharePoint, OneDrive, and any federated apps .

Multiple sources describe the same core mechanism: the proxy creates real-time bidirectional communication, whereas traditional phishing merely clones login pages and harvests credentials . Because the session token proves the user already passed MFA, the attacker never needs to crack the MFA itself .

Why Standard MFA Is Not Enough

Microsoft's own documentation warns that AiTM phishing defeats common MFA methods like SMS codes, authenticator app push notifications, and TOTP tokens . The session cookie issued after MFA completes is the prize: if stolen, it can be replayed from any device, anywhere, until the token expires or is administratively revoked.

Infoblox's report emphasizes that traditional MFA is insufficient because AiTM proxies steal the session token issued after MFA completes . The underlying problem is architectural: the proxy sits between the user and the real authentication endpoint in a way that classic MFA cannot detect.

Defenses Beyond MFA Recommended by Infoblox

Infoblox recommends a layered defense strategy that does not rely on MFA as a single point of failure. Their primary recommendations include:

1. DNS-layer security – Block known malicious domains and newly registered algorithmic domains (RDGAs) at the DNS level to disrupt phishing infrastructure before users can reach it .
2. Phishing-resistant credentials – Deploy FIDO2/WebAuthn hardware security keys or Windows Hello for Business. These use public-key cryptography bound to a specific origin. An AiTM proxy cannot forward FIDO2 challenges because the cryptographic assertion is tied to the legitimate site's domain, not to the proxy.
3. Conditional Access policies – Enforce strict sign-in risk policies in Microsoft Entra ID, such as requiring token binding, blocking sign-ins from unusual locations or devices, and shortening session lifetimes to reduce the window of cookie replay.
4. Exposure management and brand monitoring – Proactively detect phishing domains that impersonate the organization and takedown infrastructure before users encounter the lures .
5. Security awareness and reporting – Train users to recognize procurement-themed phishing lures and to report suspicious emails, enabling faster SOC response.

The FBI has also warned specifically about Kali365, advising organizations to audit their MFA methods, review sign-in logs for anomalous device code flows, and consider blocking device code authentication for all users except trusted applications .

Evidence Limitations and Scope

The Infoblox report is the primary source for the campaign's name, targeting of EU/UN institutions, and use of compromised Outlook mailboxes and small-business sites. Secondary reporting independently confirms the targets and kit rotation.

The Kali365 component is independently confirmed by the FBI's PSA and by security vendors Huntress and Paubox , but Infoblox's report groups it alongside EvilProxy and FlowerStorm under the same procurement-themed infrastructure.

The defensive recommendations combine direct statements from Infoblox's report with well-established industry best practices documented across multiple sources . No single paragraph in the sources enumerates every defensive item in bullet-point form; the list above synthesizes the guidance found across the cited material.

The Bottom Line

"The Procurement Trap" illustrates a growing trend: threat actors are not trying to crack MFA—they are sidestepping it entirely by stealing the session cookies issued after successful authentication. Technical countermeasures like FIDO2 hardware keys and DNS-level domain blocking can significantly reduce exposure, but the first line of defense remains user vigilance. Organizations using Microsoft 365 should review their authentication logs for unexpected device code or AiTM patterns and implement phishing-resistant credentials as a priority.