Microsoft Threat Intelligence has deconstructed a sophisticated credential theft campaign that successfully targeted 35,000 users across 13,000 organizations. The operation, occurring between April 14 and 16, 2026, utilized 'Code of Conduct' themed lures—a high-efficacy social engineering tactic that exploits corporate compliance requirements. The technical core of the attack involved directing users to attacker-controlled domains designed to harvest authentication tokens, bypassing traditional Multi-Factor Authentication (MFA) via Adversary-in-the-Middle (AiTM) techniques. This campaign highlights the industrial scale of modern phishing, where legitimate email services are weaponized to deliver lures that appear indistinguishable from internal HR communications. The geographic breadth (26 countries) suggests a highly organized threat actor with the infrastructure to manage massive data inflows and automated token validation.