Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog posts summarize multiple active threats and defenses: Defender Research uncovered a large-scale, multi-stage ‘code of conduct’ credential‑theft phishing campaign that uses legitimate email services and fully authenticated messages from attacker-controlled domains to perform AiTM (Adversary‑in‑the‑Middle) token compromise. Microsoft also reports Q1‑2026 email trends (increases in credential phishing, QR‑code phishing, and CAPTCHA‑gated campaigns; disruption of the Tycoon2FA platform) and published mitigation guidance. Separately, a high‑severity Linux vulnerability—CVE-0