Microsoft 365 AitM phishing is quietly harvesting payroll and finance emails—are firms ready for the next wave?

Cybersecurity researchers say a widespread email-driven phishing campaign is using adversary-in-the-middle (AitM) techniques to hijack Microsoft 365 accounts. The operation is designed to identify key personnel involved in payroll and finance workflows, then collect related email content that can be used for follow-on fraud or impersonation. The reporting frames the campaign as active and scalable, implying attackers can repeatedly compromise accounts and expand their access to corporate communications. Separately, Indian authorities warned corporate staff and financial professionals about “boss scam” fraud that targets WhatsApp accounts through fake “account details,” and misleading MCA and RBI-related documents. The common thread is social engineering married to account takeover, with attackers seeking the same high-value artifacts: finance contacts, payment instructions, and internal approval chains. Geopolitically, these incidents matter because they show how cybercrime can mimic state-grade tradecraft while exploiting the same identity and trust infrastructure that governments and large firms rely on. Microsoft 365 account compromise is particularly consequential because it can bypass many perimeter defenses and turn routine business email into an intelligence and fraud pipeline. The “boss scam” warning highlights how attackers are adapting to local compliance ecosystems by weaponizing references to Indian regulatory filings and payment authority narratives. This shifts the power dynamic toward attackers who can rapidly learn organizational structures and then pressure finance teams with convincing, context-rich messages. Victims—banks, payroll providers, and multinational employers—bear the operational cost through incident response, potential fraud losses, and reputational damage, while defenders face a race to detect credential theft and session hijacking. Market and economic implications are likely to concentrate in cybersecurity spending, identity and access management (IAM) tooling, and incident-response services. Firms using Microsoft 365 may see increased demand for conditional access hardening, phishing-resistant authentication, and email security controls, which can lift near-term budgets for vendors in the security stack. If payroll and finance email harvesting enables payment redirection or invoice fraud, the immediate financial exposure can be material even without a large headline breach, because attackers target high-frequency transaction workflows. For India, the “boss scam” focus on WhatsApp suggests additional pressure on mobile security posture and customer-support processes, potentially increasing costs for telecom-linked fraud mitigation and fraud analytics. While no direct commodity or FX move is explicitly tied to these reports, the risk premium for cyber-insurance and the volatility in security-related equities can rise as incidents cluster around common platforms like Microsoft 365. What to watch next is whether defenders observe a measurable uptick in AitM-style session hijacking attempts against Microsoft 365 tenants, and whether threat actors pivot from account takeover to payment fraud at scale. Key indicators include spikes in suspicious sign-ins, anomalous OAuth consent grants, unusual mailbox rule creation, and rapid changes in forwarding or delegation settings. For India, monitor for increased “boss scam” reports that cite MCA/RBI documents and fake account detail PDFs, especially when they originate from compromised WhatsApp numbers. Trigger points should include any evidence of successful payroll workflow manipulation, such as fraudulent payment approvals, altered beneficiary details, or repeated impersonation of finance leadership. Over the next days to weeks, escalation risk rises if organizations delay MFA enforcement, fail to validate out-of-band payment changes, or do not deploy phishing-resistant authentication across finance and HR systems.

Geopolitical Implications

• 01

  Cybercriminal tradecraft is increasingly platform-centric (Microsoft 365, WhatsApp), enabling rapid scaling of identity-based fraud that can disrupt national and corporate economic functions.

• 02

  Regulatory-themed social engineering (MCA/RBI references) suggests attackers tailor lures to local compliance narratives, raising the bar for corporate training and verification workflows.

• 03

  Account takeover targeting finance and payroll can create cascading operational and reputational impacts that resemble strategic disruption even without kinetic conflict.

Key Signals

• —Increase in AitM-style phishing detections and suspicious OAuth consent events against Microsoft 365 tenants.
• —Growth in reports of WhatsApp “boss scam” using MCA/RBI document lures and fake account detail PDFs.
• —Evidence of mailbox rule creation, forwarding changes, or delegation after account compromise.
• —Finance workflow anomalies: beneficiary detail changes, unusual approval chains, or repeated impersonation attempts.