Hackers Abuse Compromised M365 Accounts to Scale CodeStorm Phishing Operations

Cybersecuritynews •Tushar Subhra Dutta • June 23, 2026

Hackers are taking phishing to new levels by abusing legitimate Microsoft 365 accounts to supercharge an operation known as CodeStorm. Instead of building fake infrastructure from scratch, attackers are hijacking real M365 accounts and using them as trusted launching pads. This approach lets malicious emails slip past filters that would normally flag suspicious senders, dramatically […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CodeStorm Phishing Campaign Exploits M365 Accounts for Enhanced Attacks A phishing campaign attributed to the CodeStorm group is targeting Microsoft 365 tenants by leveraging compromised accounts. Attackers are using a tenant-aware AiTM phishing kit that employs rotating frontends and backend replay behavior, making it difficult for secure email gateways to detect. This method allows malicious emails to bypass traditional filters, increasing the likelihood of successful phishing attempts. The campaign's scope includes multiple organizations, with a focus on exploiting legitimate M365 accounts to enhance the credibility of phishing messages. As of June 23, 2026, the campaign is ongoing, and organizations are urged to remain vigilant against these sophisticated phishing tactics. 2 sources 65

Extracted Entities

Hackers Abuse Compromised M365 Accounts to Scale CodeStorm Phishing Operations

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (1)