Tag
7 articles covering AiTM across campaign analysis, detection engineering, and defender tradecraft.
Field Analysis
Microsoft tracked Storm-3121 and Storm-3032 running passkey-themed helpdesk calls since May 2026. The passkey narrative is a pretext that routes victims into AiTM and device-code flows — and the detection lives in what happens after the token lands, not in the lure.
Read more:Microsoft Security BlogBleepingComputer
Field Analysis
Reverse-proxy phishing kits commoditized session-token theft over the last two years. The kit market now resembles SaaS, and that has implications for how defenders track operators.
Read more:Microsoft Threat IntelligenceSekoia
Field Analysis
A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.
Read more:Datadog Security LabsNVISO Labs
Field Analysis
Microsoft detailed an April 2026 campaign that wrapped credential theft in HR disciplinary language, used a CAPTCHA as an anti-analysis gate, and stole tokens through an adversary-in-the-middle proxy.
Read more:Microsoft Security BlogThe Hacker News
Field Analysis
Recent code-of-conduct phishing campaigns show how attackers blend HR pressure, PDF staging, CAPTCHA gates, and AiTM flows to steal session tokens.
Field Analysis
Storm-1747 sells Tycoon 2FA - one of the most prolific reverse-proxy phishing kits in current circulation. This brief is what a defender team needs to know about the operator class.
Read more:Microsoft Threat IntelligenceSekoia
Field Analysis
AitM kits proxy a real identity provider page, so brand and URL checks fail. The detectable artifacts live one layer down - in TLS handshake fingerprints, in the cookies the proxy must rewrite, and in the small page-side tells that betray the relay.
Read more:SekoiaMicrosoft Threat Intelligence