Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog reports a large-scale, multi-stage credential‑theft phishing campaign that used ‘code of conduct’ lures, legitimate email services, and fully authenticated messages from attacker-controlled domains to perform AiTM (adversary-in-the-middle) token compromise. The feed also highlights a high‑severity Linux vulnerability (CVE-2026-31431, “Copy Fail”) enabling root privilege escalation across cloud and Kubernetes workloads with exploits observed in the wild, Q1‑2026 email threat trends (rise in credential, QR code, and CAPTCHA‑gated phishing and disruption of the Tycoon2FA平台