Key points
- Attackers use fake AI search results to trick users into pasting malicious terminal commands.
- Stolen Microsoft session cookies allow bypassing password and MFA authentication for inbox access.
- Hidden inbox rules and deleted sent items conceal the business email compromise activity from victims.
Huntress published research detailing a rapid business email compromise attack chain that exploits user trust in artificial intelligence platforms. The report outlines how a fictional finance employee named Doris Stewart became the victim of this multi-stage intrusion. The attack sequence began with a search for ChatGPT and concluded with a fraudulent payment request, all occurring within a 24-hour window.
The attacker lured the victim to a custom-built GPT interface via a sponsored search result. This interface displayed a fake service issue, prompting the user to execute a ClickFix-style command in the macOS Terminal. By pasting the provided command, the victim inadvertently ran a script that harvested browser cookies, including the active Microsoft 365 session token.
The Attack Mechanism
The stolen session cookie allowed the attacker to access the victim's Outlook inbox without triggering password or multi-factor authentication prompts. According to Huntress Principal Product Researcher Truman Kain, the attacker used a free browser extension to inject the cookie into a new session. This method effectively bypassed standard identity protections because the session was already authenticated. The attacker then operated with full control over the mailbox, appearing as the legitimate user.
Once inside the inbox, the attacker identified an invoice awaiting approval. They created a hidden inbox rule named ".." to archive messages containing the specific invoice number, effectively hiding the evidence from the victim. The attacker then replied to the treasury department, requesting a change to the payment routing number. After sending the fraudulent message, they deleted it from the sent folder and emptied the trash to cover their tracks.
Who Is Affected
This attack vector targets environments where users interact with AI platforms and have active Microsoft 365 sessions. The research highlights that the initial access vector relies on social engineering rather than technical exploits of the software itself. Any organization whose employees use macOS and perform terminal commands based on online instructions is potentially exposed to this ClickFix technique. The speed of the attack means detection often lags behind the financial impact.
Next steps
Huntress notes that the initial access leaves specific forensic artifacts on the endpoint. Security teams should monitor for Mac shells running curl commands with Base64-encoded attacker IP addresses. These indicators match the exact command the victim pasted into the Terminal. On the identity side, unusual inbox rule creation and immediate deletion of sent items are key tells. No patch has been confirmed yet for the social engineering aspect, so behavioral monitoring remains the primary defense.
Signals worth monitoring
Teams usually detect this activity by reviewing endpoint logs for suspicious shell executions involving curl or base64 encoding. Check whether users are pasting commands from unverified sources into terminal windows. Monitor identity logs for new inbox rules created shortly after login events, especially those with obscure names. Look for discrepancies between sent items and actual outbound traffic. Verify that session cookie theft attempts are blocked by reviewing browser extension permissions and download logs.
What to do and how to stay safe: Huntress
- Monitor endpoint logs for shell commands containing encoded URLs or external IP addresses, especially those executed via copy-paste.
- Review Microsoft 365 audit logs for the creation of new inbox rules, particularly those with minimal characters or unusual naming conventions.
- Verify the legitimacy of AI platform interactions by ensuring users only access official domains and do not execute terminal commands from chat interfaces.
- Implement alerts for immediate deletion of sent items followed by emptying of the trash folder, as this pattern often indicates malicious cover-up.
Step-by-step guide: Phishing Defined: Anatomy of the Attack and Risk Reduction
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this attack require a software vulnerability?
No, the attack relies on social engineering and user error to execute malicious commands and steal session cookies.
How did the attacker bypass multi-factor authentication?
The attacker stole an existing session cookie, which allowed them to access the account without triggering new authentication prompts.
What was the final goal of the attack?
The attacker aimed to execute business email compromise by redirecting an invoice payment to a fraudulent routing number.
