Defending against AiTM phishing and BEC - suggestions?

From the article on Microsoft Threat Intelligence Center, an attacker attempts to obtain a target user’s session cookie so they can skip the whole authentication process and act on the latter’s behalf by using a proxy server. Once the target entered their credentials and got authenticated, they were redirected to the legitimate office.com page, However, in the background, the attacker intercepted said credentials and got authenticated on the user's behalf. This allowed the attacker to perform follow-on activities

[https://www.microsoft.com/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/](https://www.microsoft.com/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/)


Would …

aitm phishing bec cybersecurity phishing