#adversaryinthemiddle — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #adversaryinthemiddle, aggregated by home.social.
-
Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress researchers discovered Knight Office, a phishing kit utilizing Adversary-in-the-Middle techniques to steal Microsoft 365 session tokens. The attack chain begins with DocuSign-themed phishing emails containing redirects through Monday.com and compromised Joomla websites. Victims are directed to credential capture pages where session tokens are harvested and fed into the Knight Office console. These stolen tokens enable attackers to bypass multi-factor authentication entirely by using already-authenticated sessions. In one incident, attackers registered rogue devices in Microsoft Entra ID and bound Windows Hello for Business credentials for persistence. Analysis revealed nine phishing attacks linked to this kit over two weeks, with hundreds of related emails reported since April. The console, hosted at IP 104.37.188.94, manages at least 25 phishing domains using .vu top-level domains.
Pulse ID: 6a9826f70dafef0cf167f596
Pulse Link: https://otx.alienvault.com/pulse/6a9826f70dafef0cf167f596
Pulse Author: AlienVault
Created: 2026-09-02 13:39:03Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AdversaryInTheMiddle #AitM #CyberSecurity #Email #InfoSec #Knight #Microsoft #OTX #Office #OpenThreatExchange #Phishing #Windows #bot #AlienVault