Several Norwegian organisations are currently being hit by an extensive and ongoing phishing attack. The attack has been confirmed by several key SOC teams, and primarily targets email users and Microsoft accounts in Norwegian businesses.

The attack is spread via email and impersonates well-known services such as SharePoint and OneDrive. Recipients are lured into clicking links and logging into fake pages that are designed to appear completely legitimate.

More advanced than traditional phishing

What makes this attack particularly severe is the use of advanced phishing techniques, including Adversary-in-the-Middle (AiTM). This method enables attackers to steal both login credentials and active session tokens.

The consequence is that:

• multi-factor authentication (MFA) can be bypassed

• traditional phishing protections do not always catch the attack

• the end user is often completely unaware that their account has been compromised

This means that an account can be further exploited without triggering alerts or suspicious activity noticed by the user themselves.

Lack of alerts does not mean lack of attack

Our SOC team has been working around the clock over the past 24 hours and has already uncovered more than 60 compromised users. In these instances, not a single alert has been triggered from Microsoft, despite several of the clients holding E5 licensing.

This underlines a crucial point: The absence of alerts does not mean an absence of compromise.

Therefore, it is essential to be proactive, both technically and organisationally.

What should organisations do now?

Organisations are urged to:

• be extra vigilant regarding unexpected emails and sharing requests

• investigate immediately if anyone may have clicked on links or logged in

• assess their own protection if they lack phishing-resistant authentication or restrictions to approved devices

If you have an in-house SOC or security partner, it is recommended to initiate active threat hunting immediately.

Prompt notification is crucial

If a user has clicked on a phishing email and entered their username or password, this must be handled immediately to prevent further misuse of the account.

In case of suspected phishing or compromise:

• Contact Procano Support immediately

• Email: servicedesk@procano.com

• Telephone (urgent): +47 22 52 50 00

Early remediation can be decisive in limiting the extent of damage.

A clear rule in a demanding digital everyday life

Phishing attacks are becoming increasingly sophisticated and more difficult to detect. In a global digital working environment, vigilance is one of the most important security measures we have.

Do not click on anything you are not 100% sure about.

Pausing and reporting early can make all the difference.