Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog posts (Apr–May 2026) highlight several urgent security developments: a large-scale multi-stage “code of conduct” credential-phishing campaign that uses legitimate email services and authenticated attacker-controlled domains to perform AiTM (adversary-in-the-middle) token compromise; a high-severity Linux privilege escalation vulnerability (CVE-2026-31431, “Copy Fail”) with exploits in the wild affecting cloud and Kubernetes workloads; and continued escalation in email-based threats (credential phishing, QR-code phishing, CAPTCHA-gated campaigns) including disruption of