Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise
2026-05-05T08:52:23Z•ca4d514aacdc8bd34fc2c9fa7fe72e499db74ddb0b107a3fa3902ee641299446
Agent 365AiTMCAPTCHA-gated campaignsCVE-2026-31431Copy FailKubernetesLinux privilege escalationQR code phishingSentinel UEBATycoon2FAcloud securitycredential theftemail threatsidentity detectionphishingshadow AI
What happened
Microsoft Security Blog items (Apr–May 2026) highlight multiple urgent security topics: a large-scale multi-stage “code of conduct” phishing campaign that abuses legitimate email services to deliver fully authenticated messages and AiTM (adversary-in-the-middle) token/credential theft; a high-severity Linux privilege‑escalation vulnerability (Copy Fail, CVE-2026-31431) with exploits in the wild affecting cloud and Kubernetes workloads; general availability of Agent 365 with shadow‑AI discovery and management capabilities; Q1 2026 email threat trends (rising credential, QR code, and CAPTCHA‑g-g
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- ca4d514aacdc8bd34fc2c9fa7fe72e499db74ddb0b107a3fa3902ee641299446
- Enrichment time
- 2026-05-05T08:52:23Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.