Aitm

Threat actors are leveraging Adversary-in-the-Middle relays to capture M365 authentication tokens and bypass MFA, resulting in unauthorized account access, rogue device registration, and malicious inbox rule creation across multiple organizations.

An APT actor is targeting Taiwan-based researchers with AI-assisted event-themed spear-phishing and quishing, leveraging an adversary-in-the-middle (AitM) framework to intercept Google credentials and bypass MFA.

China-aligned actor TA419 is conducting targeted, long-tail credential phishing campaigns against US and Japanese AI policy and national security experts using AitM techniques and a custom Frameless BitB toolkit to capture MFA-protected Microsoft 365 sessions.

Three suspected Russian threat clusters are actively conducting targeted phishing campaigns using OAuth abuse, device code manipulation, and AitM attacks via compromised Wi-Fi gateways to hijack credentials and deploy infostealers.

Threat actors are increasingly abusing reputable PaaS providers to host multi-stage AitM phishing campaigns that use browser service workers and the Ultraviolet library to intercept credentials and MFA tokens.

O-UNC-038 is conducting a multi-stage Adversary-in-the-Middle (AiTM) phishing operation that abuses legitimate SaaS platforms and recruiter identities to steal corporate Google Workspace credentials and bypass multi-factor authentication.

This rule detects Microsoft 365 audit events indicative of Tycoon 2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity, identifying UserLoggedIn events where the Microsoft Authentication Broker requests access to Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents, bypassing MFA by relaying authentication and capturing session material.

Detects Microsoft Entra ID sign-ins consistent with Tycoon2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity targeting Microsoft 365 and Gmail, where the Microsoft Authentication Broker requests tokens for Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents (node, axios, undici).

UNC6671, operating under the "BlackFile" brand, conducts a sophisticated extortion campaign targeting organizations through voice phishing (vishing) and single sign-on (SSO) compromise, using adversary-in-the-middle (AiTM) techniques to bypass MFA and exfiltrate sensitive corporate data.

A sophisticated phishing campaign targeting US organizations uses a 'code of conduct review' theme to lure victims to a malicious website, employing adversary-in-the-middle (AitM) techniques to capture authentication tokens and gain account access.

A widespread phishing campaign utilized 'code of conduct' lures, a multi-step attack chain, and legitimate email services to distribute authenticated messages from attacker-controlled domains, ultimately leading to adversary-in-the-middle (AiTM) token compromise, primarily targeting US-based organizations.

The Tycoon2FA Phishing-as-a-Service (PhaaS) platform, disrupted by Europol on March 4, 2026, has shown resilience with campaign activity returning to pre-disruption levels, employing adversary-in-the-middle (AITM) techniques to intercept authentication sessions and bypass MFA, highlighting the need for continuous vigilance and robust detection capabilities.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

An adversary may compromise user credentials and conduct an Adversary-in-the-Middle (AiTM) attack, granting them unauthorized access to an Office 365 account from multiple IP addresses simultaneously, potentially leading to data theft, account takeover, and internal phishing campaigns.