The development
In May 2026, Microsoft described a multi-stage phishing campaign that used a “code of conduct” theme and led to adversary-in-the-middle token compromise. Microsoft reported observing the activity between April 14 and April 16, 2026, across more than 13,000 organizations in 26 countries. The report identified healthcare and life sciences, financial services, professional services, and technology among the most affected sectors in its observations.
Those figures describe Microsoft’s observed campaign, not a complete measurement of all phishing activity and not a forecast for every Central Florida business. The confirmed development is more important than the headline count: attackers are combining social engineering, fake sign-in experiences, and stolen authentication tokens to get around assumptions that a password or ordinary MFA prompt is enough.
Why office routines are exposed
Professional offices routinely receive messages about policies, shared documents, password expiration, voicemail, payroll, invoices, and human-resources tasks. These subjects are plausible because they match normal administrative work. An employee may not see an obvious spelling mistake or suspicious attachment.
The risk is also not limited to email. A compromised session may give an attacker access to cloud files, mailboxes, contacts, calendars, collaboration tools, and connected applications. The amount of access depends on the account, tenant configuration, token validity, application permissions, and additional controls.
Upgrade verification, not just awareness training
Training should teach people how to verify a request, not merely how to identify bad grammar. For sensitive actions, require a second channel or a known approval workflow:
- Verify bank-account changes using a trusted phone number already on file.
- Confirm urgent executive requests outside the message thread.
- Open shared documents through the normal company portal rather than an unexpected link.
- Treat sign-in prompts that appear without a user-initiated action as suspicious.
- Report unexpected MFA prompts immediately.
- Never approve an authentication request simply to make an alert disappear.
The goal is to make safe behavior the easy behavior.
Move priority users toward phishing-resistant MFA
Microsoft’s guidance points toward passwordless and phishing-resistant methods such as FIDO2 security keys, Windows Hello for Business, and passkeys. Organizations should evaluate compatibility, licensing, device support, recovery procedures, and accessibility before deployment.
Start with users who have the greatest ability to move money, access sensitive records, administer systems, or approve technology changes. Administrators should not be the only people protected; finance, executives, human resources, and high-value client-service roles also deserve priority.
Review cloud configuration
Office managers should ask their provider to review:
- Conditional-access policies.
- Legacy authentication.
- Administrator roles.
- Risky sign-in and impossible-travel alerts.
- Mailbox forwarding and inbox rules.
- Application consent and third-party integrations.
- Session and token controls available in the tenant.
- Audit logging and alert ownership.
A provider should explain what is enabled, what is unavailable under the current license, and what compensating process exists.
Prepare for token compromise
A stolen token may require more than a password reset. The response process should include revoking sessions where appropriate, resetting credentials, reviewing authentication methods, removing malicious inbox rules, checking application grants, examining sign-in and audit logs, and determining what information the account could access.
Do not assume that the first suspicious message is the full scope of the incident. The account may have been accessed earlier, and the attacker may have used it to send convincing messages to colleagues or clients.
What remains uncertain
It is not confirmed that a particular Central Florida business has been targeted by the Microsoft-reported campaign. It is also not possible to determine from a public report whether an individual tenant’s controls would have blocked the activity. The right response is not panic or a claim of guaranteed protection. It is a measured review of identity controls, user workflows, logging, and incident readiness.
A practical 14-day response
Within two days, remind staff to report unexpected MFA prompts and verify payment changes out of band. Within one week, inventory privileged users and review forwarding rules, application grants, and sign-in alerts. Within two weeks, test a compromised-account response and identify whether priority users can use phishing-resistant authentication.
AI may make phishing content more convincing, but the defensive answer remains human governance supported by stronger identity controls. Offices that define approval paths, limit access, and practice recovery will be better positioned than offices that rely on employee suspicion alone.
Sources
Microsoft token-compromise campaign report: https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/
Microsoft domain-spoofing and phishing guidance: https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/
Microsoft cloud identity compromise report: https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/
CISA MFA guidance: https://www.cisa.gov/audiences/small-and-medium-sized-businesses/secure-your-business/require-multifactor-authentication