A widespread email-driven phishing campaign is employing Adversary-in-the-Middle (AitM) techniques to compromise Microsoft 365 accounts. Attackers use residential proxies to disguise malicious sign-ins, aiming to identify key personnel in financial workflows and collect related emails. This campaign poses a significant threat to organizations using Microsoft 365.