35,000 Users in 48 Hours: How AiTM Phishing Exploits Email Routing Gaps That DMARC Can Close

Thu, 21 May 2026 08:00:00 +0000

On April 14, 2026, a phishing campaign began reaching inboxes at healthcare systems, banks, law firms, and technology companies across 26 countries. By April 16, it was over. In those 48 hours, Microsoft’s threat intelligence team had logged more than 35,000 targeted users at more than 13,000 organizations. Ninety-two percent were in the United States.

Microsoft published its analysis on May 4, 2026. The campaign used adversary-in-the-middle (AiTM) infrastructure to harvest session tokens in real time, which means it bypassed multi-factor authentication entirely. But before any token was stolen, the attack had to get into an inbox. That first step, delivery, is where email authentication either holds the line or fails.

Mfa on Daily DMARC News

35,000 Users in 48 Hours: How AiTM Phishing Exploits Email Routing Gaps That DMARC Can Close