Hackers Target US and EU Firms With Microsoft 365 Session Hijacking and RMM Abuse
Brief
A wave of cyberattacks across the US and Europe in August exploited the trust businesses place in everyday tools, turning Microsoft 365 logins, remote-management software, and routine business documents into entry points for attackers.
Security researchers tracked campaigns that combined account takeover, persistent remote access, and credential theft, often disguised as legitimate activity.
Microsoft 365 Session Hijacking
Research from ANY.RUN, highlighted in their August cyberattack analysis, uncovered a phishing operation spanning 46 countries, with nearly half of observed activity tied to the United States.
Attackers used fake tax notices, invoices, and shipping documents to trick victims into installing signed remote management tools such as ScreenConnect, ConnectWise, and LogMeIn Rescue.