CodeStorm Phishing Campaign Targets M365 Tenants With Token Reuse and Replay Attacks

Gbhackers •Mayura Kathir • June 23, 2026

A multi-organization phishing campaign attributed to the CodeStorm family is actively targeting Microsoft 365 tenants with a tenant-aware AiTM (adversary-in-the-middle) phishing kit that combines rotating frontends and backend replay behavior under a stable controller path, /google.php. The human recipient rarely scrolls to that dummy conversation, but automated secure email gateways frequently do; the added “conversation […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CodeStorm Phishing Campaign Exploits M365 Accounts for Enhanced Attacks A phishing campaign attributed to the CodeStorm group is targeting Microsoft 365 tenants by leveraging compromised accounts. Attackers are using a tenant-aware AiTM phishing kit that employs rotating frontends and backend replay behavior, making it difficult for secure email gateways to detect. This method allows malicious emails to bypass traditional filters, increasing the likelihood of successful phishing attempts. The campaign's scope includes multiple organizations, with a focus on exploiting legitimate M365 accounts to enhance the credibility of phishing messages. As of June 23, 2026, the campaign is ongoing, and organizations are urged to remain vigilant against these sophisticated phishing tactics. 2 sources 65

Extracted Entities

CodeStorm Phishing Campaign Targets M365 Tenants With Token Reuse and Replay Attacks

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)