Infrastructure Intelligence

Adversary infrastructure: phishing kits, AiTM frameworks, redirector chains, and sending abuse.

Infrastructure Intelligence Archive

15 entries

Field Analysis

Dual UseInfrastructure IntelligenceOct 15, 20268 min read

The Phish Ends. The Connection Doesn’t.

AvisLoader shows why taking down a lure does not establish that a compromised endpoint has lost its control channel. Examine Tox-based communications, ToxNetV2 as a separate Radar companion, and assessment objectives for detection, privacy, and containment.

EvilTokens Goes Down: What a PhaaS Takedown Actually Buys You

Microsoft's DCU disrupted EvilTokens on September 22, 2026 — a $1,500 device-code phishing platform tied to 12,000 compromised inboxes across 10,000 organisations. The operator is gone. The flow it abused is unchanged, and the serverless infrastructure pattern is the part that outlives the brand.

By PhishPond Desk

Field Analysis

Red TeamInfrastructure IntelligenceJul 19, 202612 min read

The 2024–2026 AitM Phishing-as-a-Service Market: Tycoon, EvilProxy, Mamba, Greatness

Reverse-proxy phishing kits commoditized session-token theft over the last two years. The kit market now resembles SaaS, and that has implications for how defenders track operators.

By PhishPond Desk

Field Analysis

Dual UseInfrastructure IntelligenceJul 19, 202610 min read

The Console Is the New Inbox: AiTM Phishing Comes for AWS Sign-In

A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.

By PhishPond Desk

Field Analysis

Dual UseInfrastructure IntelligenceJul 19, 202611 min read

The Hosting Layer Nobody Blocks: Bulletproof Providers, Takedowns, and the CDN Hop

Phishing kits get the headlines, but the hosting underneath them is the durable asset. A May 2026 seizure of 800+ servers, resilient scanning networks, and the routine hop behind a CDN show why takedowns rarely stick and where the defensible signal actually lives.

By PhishPond Desk

Field Analysis

Blue TeamInfrastructure IntelligenceJun 12, 202613 min read

Trusted Notification Systems Are Becoming Phishing Delivery

Scammers abusing a real Microsoft account-alert sender are part of a wider pattern: attackers are turning legitimate SaaS notification workflows into authenticated phishing infrastructure.

Kali365 Outgrows Microsoft 365: Operator Pivots to Okta, AWS, and a Russian-Language Cluster

Arctic Wolf's June 2 follow-up describes the Kali365 operator expanding well beyond Microsoft 365: Okta SSO, Xerox DocuShare, AWS-style endpoints, and a Russian-language cluster including MAX Messenger account takeover via real SMS OTPs. Proofpoint's research places the kit inside a broader cluster of AI-generated device-code lookalikes.

TrapDoor's Cross-Ecosystem Campaign Adds AI-Assistant Poisoning to Supply-Chain Tradecraft

Socket attributes a coordinated supply-chain campaign called TrapDoor to roughly thirty-four packages across npm, PyPI, and Crates.io, with ecosystem-specific execution paths and a new twist: planted .cursorrules and CLAUDE.md files designed to influence the developer's AI coding assistant.

Kali365 and the Productization of Token Theft

An FBI-flagged phishing-as-a-service kit rents Microsoft 365 token theft for $250 a month, packaging device-code and OAuth abuse into a point-and-click dashboard that defeats MFA without a fake login page.

Trusted Email Infrastructure Is Now Part of the Phishing Supply Chain

Abuse of legitimate email services such as Amazon SES shows why authentication pass results are not the same thing as sender trust.

By PhishPond Desk

Field Analysis

Red TeamInfrastructure IntelligenceMay 1, 20269 min read

Bluekit Shows Phishing Kits Are Becoming Campaign Workbenches

A newly reported kit packages templates, domain setup, anti-analysis controls, session monitoring, and AI-assisted drafting into one operator console.

SVG Phishing Payloads: How Inline Script and ForeignObject Slip Most SEGs

SVG attachments became one of 2024 and 2025's fastest-growing phishing payload formats. The reason isn't novelty - it is that SVG sits in a parsing gap most secure email gateways inherit.

Credential Harvesting Kits Adopt Device-Bound Session Replay Tactics

New phishing kits are pivoting from simple password theft to real-time token capture and replay workflows targeting modern MFA deployments.

By PhishPond Desk

Field Analysis

Red TeamInfrastructure IntelligenceApr 4, 202611 min read

Research Note: Brand Impersonation Infrastructure in Consumer Finance

A longitudinal study tracks how lookalike domains and cloned login flows are assembled and rotated across finance-themed phishing clusters.

Open Redirect Chains Still Enable Credential Theft at Scale

Attackers continue to abuse trusted domains with weak redirect controls to improve lure trust and reduce user suspicion.

Infrastructure Intelligence