Full Report
Discover how Adversary-in-the-Middle attacks silently hijack your sessions, and learn how to spot and prevent AiTM with tips from the experts at Huntress.
Analysis Summary
# Tool/Technique: Adversary-in-the-Middle (AiTM)
## Overview
Adversary-in-the-Middle (AiTM) is a sophisticated form of session hijacking where an attacker positions themselves between a user and a legitimate service (like Microsoft 365). Unlike traditional phishing that merely steals passwords, AiTM intercepts the entire authentication flow, including Multi-Factor Authentication (MFA) prompts, to capture session tokens. These tokens allow the attacker to bypass MFA and maintain persistent access to the victim's account without needing the user's credentials again.
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Web-based services, Cloud Environments (specifically M365/SaaS)
- **Capabilities:** Session hijacking, MFA bypass, real-time traffic interception, token replay.
- **First Seen:** Variations of MITM have existed for decades, but modern session-proxy AiTM kits (like Evilginx) gained prominence around 2018-2019.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1557 - Adversary-in-the-Middle]**
- **[T1111 - Two-Factor Authentication Evasion]**
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0004 - Privilege Escalation]**
- **[T1550.004 - Use Alternate Authentication Material: Web Session Cookie]**
## Functionality
### Core Capabilities
- **Reverse Proxying:** The attacker hosts a proxy server that mirrors the legitimate login page (e.g., Office 365) to the user in real-time.
- **Session Token Theft (Pickpocketing):** Intercepts the final session cookie sent by the legitimate service after successful MFA completion.
- **Credential Harvesting:** Captures usernames and passwords as they are typed.
### Advanced Features
- **MFA Interception:** Forwards MFA prompts to the user and passes the response back to the legitimate site, making the attack transparent.
- **HTML Smuggling:** Using encoded scripts within HTML files to bypass email filters and deliver malicious payloads or redirects.
- **PaaS Weaponization:** Using legitimate platforms like `railway[.]com` to host attack infrastructure, ensuring high reputation and bypassing domain filters.
- **Automation Kits:** Use of pre-built frameworks like "Knight Office" which include custom control panels and Cloudflare Turnstile integration to evade automated scanners.
## Indicators of Compromise
- **File Names:** Frequently involves `Unauthorized.html` or similarly named files in HTML smuggling attempts.
- **Network Indicators:**
- `railway[.]app` (abused PaaS infrastructure)
- Domains mimicking legitimate logins (e.g., `login.microsoftonline.us-west[.]com`)
- Use of Cloudflare Turnstile or CAPTCHAs on non-standard login pages.
- **Behavioral Indicators:**
- Logins from atypical locations or ISPs (e.g., hosting providers like DigitalOcean or AWS).
- Multiple successful logins for a single user from different IP addresses within a short timeframe (Session Replay).
- Creation of new inbox rules immediately following a login.
## Associated Threat Actors
- **Storm-0857** (Associated with Knight Office kit)
- **General Cybercrime Groups:** Widely used by Business Email Compromise (BEC) actors.
## Detection Methods
- **Behavioral Detection:** Monitor for "impossible travel" alerts and logins originating from known proxy/hosting IP ranges rather than residential/corporate ISPs.
- **Identity Threat Detection (ITDR):** Analyze authentication logs for anomalies in User-Agent strings or unexpected session persistence.
- **Token Analysis:** Look for session tokens being reused across different IP addresses or geographic locations.
## Mitigation Strategies
- **FIDO2/WebAuthn:** Use hardware security keys (like YubiKeys) which are resistant to AiTM because they bind the authentication to the specific domain.
- **Conditional Access Policies:** Restrict logins to compliant/managed devices or specific geographic regions.
- **Token Lifetime Limits:** Shorten session timeouts to reduce the window of opportunity for stolen tokens.
- **User Education:** Training users to inspect the URL bar even if the page looks identical to a standard login.
## Related Tools/Techniques
- **Evilginx2 / Evilginx3:** The industry-standard framework for AiTM.
- **Modlishka:** A reverse proxy phishing tool.
- **Muraena:** An automated AiTM tool.
- **Knight Office:** A specialized M365 AiTM phishing kit.
- **Device Code Phishing:** A related technique involving the abuse of the OAuth 2.0 device authorization flow.