Skip to content
Threat Feed

Tag

Aitm

7 briefs RSS
high advisory

Adversary-in-the-Middle Phishing via Legitimate Cloud Platforms

Threat actors are increasingly abusing reputable PaaS providers to host multi-stage AitM phishing campaigns that use browser service workers and the Ultraviolet library to intercept credentials and MFA tokens.

Cloudflare Workers +4 phishing aitm cloud credential-harvesting
2t 1i
high threat

Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials

O-UNC-038 is conducting a multi-stage Adversary-in-the-Middle (AiTM) phishing operation that abuses legitimate SaaS platforms and recruiter identities to steal corporate Google Workspace credentials and bypass multi-factor authentication.

Google Workspace O-UNC-038 phishing credential-theft aitm social-engineering mfa-bypass saas-abuse google-workspace
2r 9t 1i
high advisory

Microsoft 365 AiTM UserLoggedIn via Office App (Tycoon2FA)

This rule detects Microsoft 365 audit events indicative of Tycoon 2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity, identifying UserLoggedIn events where the Microsoft Authentication Broker requests access to Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents, bypassing MFA by relaying authentication and capturing session material.

Microsoft 365 +2 cloud identity saas microsoft365 aitm tycoon2fa phishing
2r 2t
medium advisory

Tycoon2FA AiTM Phishing via Microsoft Entra ID Sign-Ins

Detects Microsoft Entra ID sign-ins consistent with Tycoon2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity targeting Microsoft 365 and Gmail, where the Microsoft Authentication Broker requests tokens for Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents (node, axios, undici).

Microsoft Entra ID +3 tycoon2fa aitm entra_id phishing credential_access
2r 2t
high threat

UNC6671 BlackFile Vishing Extortion Campaign Targeting Microsoft 365 and Okta

UNC6671, operating under the "BlackFile" brand, conducts a sophisticated extortion campaign targeting organizations through voice phishing (vishing) and single sign-on (SSO) compromise, using adversary-in-the-middle (AiTM) techniques to bypass MFA and exfiltrate sensitive corporate data.

Microsoft 365 +5 UNC6671 vishing extortion aitm credential-theft data-exfiltration sso
2r 8t 5i
high advisory

Sophisticated AitM Phishing Campaign Targeting US Organizations

A sophisticated phishing campaign targeting US organizations uses a 'code of conduct review' theme to lure victims to a malicious website, employing adversary-in-the-middle (AitM) techniques to capture authentication tokens and gain account access.

Microsoft account +1 phishing aitm credential-access initial-access
2r 2t
high advisory

Office 365 Concurrent Sessions Indicate Adversary-in-the-Middle (AiTM) Attack

An adversary may compromise user credentials and conduct an Adversary-in-the-Middle (AiTM) attack, granting them unauthorized access to an Office 365 account from multiple IP addresses simultaneously, potentially leading to data theft, account takeover, and internal phishing campaigns.

Office 365 o365 aitm phishing credential-access
2r 1t