Skip to content
Threat Feed

Tag

Aitm

4 briefs RSS
high advisory

Microsoft 365 AiTM UserLoggedIn via Office App (Tycoon2FA)

This rule detects Microsoft 365 audit events indicative of Tycoon 2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity, identifying UserLoggedIn events where the Microsoft Authentication Broker requests access to Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents, bypassing MFA by relaying authentication and capturing session material.

Microsoft 365 +2 cloud identity saas microsoft365 aitm tycoon2fa phishing
2r 2t
medium advisory

Tycoon2FA AiTM Phishing via Microsoft Entra ID Sign-Ins

Detects Microsoft Entra ID sign-ins consistent with Tycoon2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity targeting Microsoft 365 and Gmail, where the Microsoft Authentication Broker requests tokens for Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents (node, axios, undici).

Microsoft Entra ID +3 tycoon2fa aitm entra_id phishing credential_access
2r 2t
high threat

UNC6671 BlackFile Vishing Extortion Campaign Targeting Microsoft 365 and Okta

UNC6671, operating under the "BlackFile" brand, conducts a sophisticated extortion campaign targeting organizations through voice phishing (vishing) and single sign-on (SSO) compromise, using adversary-in-the-middle (AiTM) techniques to bypass MFA and exfiltrate sensitive corporate data.

Microsoft 365 +5 UNC6671 vishing extortion aitm credential-theft data-exfiltration sso
2r 8t 5i
high advisory

Sophisticated AitM Phishing Campaign Targeting US Organizations

A sophisticated phishing campaign targeting US organizations uses a 'code of conduct review' theme to lure victims to a malicious website, employing adversary-in-the-middle (AitM) techniques to capture authentication tokens and gain account access.

Microsoft account +1 phishing aitm credential-access initial-access
2r 2t