#adversaryinthemiddle — Public Fediverse posts

Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US

Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education among the most targeted industries. The operation generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access. Once a Microsoft 365 session is hijacked, attackers gain access to corporate email, sensitive data, and trusted business accounts. The toolkit uses browser-based delivery through .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity. Of 9,426 unique targeted email addresses, 4,532 were potentially compromised, representing approximately 48% success rate.

Pulse ID: 6a84c514863d37cbadb72833
Pulse Link: https://otx.alienvault.com/pulse/6a84c514863d37cbadb72833
Pulse Author: AlienVault
Created: 2026-08-18 20:48:20

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#2FA #AdversaryInTheMiddle #AitM #Browser #Cookies #CyberSecurity #Education #Email #HTML #InfoSec #Java #JavaScript #Manufacturing #Microsoft #OTX #OpenThreatExchange #Password #Passwords #Phishing #RAT #Rust #SVG #Word #bot #AlienVault

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

Socket's Threat Research Team identified a campaign of 737 malicious VPN and proxy extensions in the Chrome Web Store, accumulating over 75,000 installs. The extensions, published across 40 developer accounts, target Russian-speaking users seeking access to blocked services. 274 extensions impersonate 66 established VPN brands including Proton VPN, NordVPN, and AmneziaVPN. The extensions route all browser traffic through SOCKS5 proxies controlled by a single operator on port 1082, placing the threat actor in an adversary-in-the-middle position. Premium subscription tiers advertise servers in five countries that do not resolve. The campaign employs DNS-over-HTTPS for evasion, post-approval code substitution, and coordinated review gaming. The operation is linked to a Russian subscription VPN business that names a tax-registered self-employed individual as the contracting party.

Pulse ID: 6a7c183cfe509b035144c5a6
Pulse Link: https://otx.alienvault.com/pulse/6a7c183cfe509b035144c5a6
Pulse Author: AlienVault
Created: 2026-08-12 06:52:44

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AdversaryInTheMiddle #Browser #Chrome #CyberSecurity #DNS #ELF #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #Proxy #RAT #Russia #Troll #VPN #bot #socks5 #AlienVault

Greatness PhaaS Steals Microsoft 365 Tokens Despite MFA

The Greatness Phishing-as-a-Service platform uses Adversary-in-the-Middle
and device-code phishing to steal Microsoft 365 authentication tokens and
bypass MFA. Active campaigns exploit trusted sender configurations and
phishing lures to compromise accounts. Stolen tokens enable attackers to
access Outlook, Teams, SharePoint and OneDrive while evading
conventional authentication-based security controls.

Pulse ID: 6a79bef48cee5cb15fd34fd2
Pulse Link: https://otx.alienvault.com/pulse/6a79bef48cee5cb15fd34fd2
Pulse Author: cryptocti
Created: 2026-08-10 12:07:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AdversaryInTheMiddle #CyberSecurity #EDR #InfoSec #MFA #Microsoft #OTX #OpenThreatExchange #Outlook #Phishing #RAT #Rust #bot #cryptocti

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

UNC6671 continues conducting data theft extortion operations despite the alleged retirement of the BlackFile brand in May 2026. The threat actor has diversified across multiple extortion fronts including Redact, Pink, Helix, and Falcon. They employ voice phishing tactics, posing as IT helpdesk staff to contact employees on personal mobile devices, directing them to spoofed login portals with Adversary-in-the-Middle infrastructure that intercepts credentials and multi-factor authentication tokens. Once access is established, automated scripts exfiltrate data from enterprise cloud environments including Microsoft 365 and Okta. Infrastructure analysis reveals shared phishing panels, overlapping victim targeting, and connected domains across all brands. Recent targeting has evolved toward financial services, private equity, legal, and professional services sectors. Between January and May 2026, Bitcoin wallet analysis showed approximately $10.69 million USD in ransom payments, with demands typically ranging fr...

Pulse ID: 6a75078f7b8e057bc29b8769
Pulse Link: https://otx.alienvault.com/pulse/6a75078f7b8e057bc29b8769
Pulse Author: AlienVault
Created: 2026-08-06 22:15:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AdversaryInTheMiddle #BitCoin #Cloud #CyberSecurity #DataTheft #Extortion #ICS #InfoSec #Microsoft #OTX #OpenThreatExchange #Phishing #RAT #RCE #bot #AlienVault

Payroll Pirates: Strange New Tides in Business Email Compromise

Arctic Wolf is tracking an active, widespread phishing campaign targeting Microsoft 365 accounts using adversary-in-the-middle (AiTM) techniques. The operation employs voicemail-themed phishing emails that redirect victims through multiple legitimate services to AiTM proxy infrastructure, which intercepts authentication sessions even when multi-factor authentication is enabled. Once compromised, threat actors use residential proxies to maintain access, conducting automated sign-ins at eight-hour intervals while collecting email from personnel involved in financial workflows. The campaign uses Microsoft Graph for reconnaissance targeting payroll, HR, and finance users, followed by coordinated mailbox collection. Activity affects organizations across healthcare, education, manufacturing, government, and professional services sectors in the United States, Canada, and Europe. The campaign shares characteristics with Microsoft-tracked Storm-2755 activity cluster.

Pulse ID: 6a7546d2694489fe6ddddcd5
Pulse Link: https://otx.alienvault.com/pulse/6a7546d2694489fe6ddddcd5
Pulse Author: AlienVault
Created: 2026-08-07 02:45:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AdversaryInTheMiddle #AitM #Canada #CyberSecurity #Education #Email #Europe #Government #Healthcare #ICS #InfoSec #Manufacturing #Microsoft #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #UnitedStates #bot #AlienVault

The Silent Breach and the Persistence of Unauthorized Access

938 words, 5 minutes read time.

Once the session token is successfully exfiltrated, the nature of the intrusion shifts from external deception to internal subversion. The attacker does not need to crack passwords or trigger further security alerts, as they are now effectively operating with the digital identity of a trusted employee. Analyzing these incidents, I see that the primary goal is often the establishment of persistence within the target environment, which is achieved through the modification of inbox rules or the creation of clandestine mailbox delegates. By silently forwarding incoming emails to an external address or creating hidden folders for sensitive correspondence, the adversary can monitor ongoing business deals, intercept financial instructions, and identify high-value targets for subsequent business email compromise attacks. This stage of the operation is characterized by extreme patience, as the threat actor avoids loud, disruptive actions in favor of a low-and-slow approach that can remain undetected for months. The tragedy is that the victim often remains entirely unaware of the breach, believing they are still securely authenticated while their environment is being methodically picked apart from the inside.

Challenging the Failure of Traditional Defensive Postures

When considering why these attacks continue to succeed with such alarming frequency, it becomes evident that the industry’s reliance on legacy defensive postures is a failing strategy. Many organizations still treat email security as a static barrier, implementing blacklists and rudimentary heuristic scans that are easily circumvented by adversaries who control their own infrastructure and rotating IP addresses. Furthermore, the human-centric nature of these scams renders technical controls inherently insufficient unless they are paired with a cultural shift toward skeptical verification. It is not enough to deploy an automated solution if the culture within a firm encourages speed over accuracy and ignores the red flags of irregular communication patterns. Consequently, the defense against these campaigns must evolve into a proactive, threat-hunting discipline that monitors for anomalous login locations, unexpected session durations, and unauthorized changes to account configurations. Without this layer of vigilant oversight, the technical barriers essentially act as a screen door, providing the illusion of protection while failing to stop the actual threat.

Implementing Rigorous Verification Protocols in a High-Stakes Environment

The path forward requires a departure from the convenience-first mindset that dominates modern digital work environments. Organizations must adopt hardware-backed authentication methods, such as FIDO2-compliant security keys, which are resistant to the proxy-based interception tactics that currently plague mobile-based push notifications and SMS codes. Additionally, the adoption of strict device posture checks ensures that an attacker cannot simply use a stolen session token from an unauthorized machine or an unrecognized geographic region. Beyond the hardware, there must be a fundamental hardening of organizational processes, such as implementing mandatory out-of-band verification for any request involving financial transfers or the sharing of sensitive credentials. It is a harsh reality that trust is the primary vulnerability in any system, and the most secure posture is one that treats every incoming request as potentially malicious until proven otherwise through independent channels. While this might introduce friction into the workflow, that friction is the necessary price of security in an age where the cost of a single successful breach is often the survival of the entity itself.

Call to Action

The time for passive observation has passed, as the threats currently infiltrating our inboxes are not waiting for an invitation to compromise your organization. You must decide whether to continue relying on outdated defensive protocols that offer only the illusion of safety or to begin the hard work of hardening your infrastructure against the reality of modern adversarial tactics. I urge you to conduct an immediate audit of your current authentication stack and evaluate the necessity of migrating to hardware-backed security keys, as this is the single most effective step you can take to neutralize the threat of proxy-based session hijacking. Furthermore, initiate a comprehensive review of your internal communication policies to ensure that your team is empowered to question anomalies rather than blindly following the path of least resistance. Security is not a product you purchase, but a discipline you practice, and the responsibility to bridge the gap between your existing defenses and the current threat reality rests entirely with you. Do not wait for a compromised session to force your hand, because by the time the impact of a breach is visible, the damage is already absolute.

D. Bryan King

Sources

• CISA: Business Email Compromise (BEC) Resources
• FBI: Business Email Compromise Information
• FIDO Alliance: Defining Phishing-Resistant Authentication
• Microsoft: Analyzing Adversary-in-the-Middle (AiTM) Techniques
• NIST: Digital Identity Guidelines
• CrowdStrike: Phishing and Social Engineering Analysis
• Palo Alto Networks: Business Email Compromise Explained
• SANS Institute: Protecting Against Advanced Email Threats
• Cybereason: BEC Threat Landscape Report
• Check Point: The Evolution of Phishing
• Proofpoint: Understanding BEC Attacks
• Dark Reading: The Mechanics of Session Hijacking
• ZDNet: The New Era of Targeted Phishing
• Wired: Why Modern Phishing is Succeeding
• Trend Micro: BEC Comprehensive Guide
• Recorded Future: BEC Trend Analysis
• Infosecurity Magazine: FIDO2 and Phishing Resistance
• Varonis: Modern Phishing Techniques Deep Dive
• CSO Online: The Mechanics of BEC
• Fortinet: Cybersecurity Glossary on BEC
• SANS: Analyzing MFA Bypass Tactics
• BleepingComputer: Evolution of Phishing Kits
• Secureworks: BEC Defensive Strategies
• CISA: Mitigating Phishing Campaigns
• Mandiant: Evolving Tactics in BEC
• NIST: Phishing Training Resources
• TechTarget: BEC Definition and Prevention
• Elastic: Detecting Phishing Infrastructure
• Rapid7: The Threat of Session Token Theft
• Cloudflare: Understanding FIDO2 Protocol

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

DEV-1101 enables high-volume AiTM campaigns with open-source phishing kit

https://www.microsoft.com/en-us/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/

#Microsoftsecurityintelligence #adversaryinthemiddle #ManintheMiddle #Cybersecurity #Microsoft #Phishing #Security