Full Report
An inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft.
Analysis Summary
# Tool/Technique: Knight Office
## Overview
Knight Office is a sophisticated Adversary-in-the-Middle (AiTM) phishing kit and management console designed to hijack Microsoft 365 (M365) and Google Workspace sessions. Its primary purpose is to bypass Multi-Factor Authentication (MFA) by capturing valid session tokens in real-time, allowing attackers to access victim accounts without needing to crack passwords or interact directly with MFA prompts.
## Technical Details
- **Type:** Phishing Kit / AiTM Framework
- **Platform:** Microsoft 365, Google Workspace, Windows (via Entra ID)
- **Capabilities:** Token theft, session hijacking, real-time victim monitoring, automated redirection, and rogue device registration.
- **First Seen:** Reported August 2026 (Note: Article date reflects a future-dated or near-future context).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557.001 - Adversary-in-the-Middle: HTTPAiTM]
- [T1539 - Steal Web Session Cookie]
- **[TA0003 - Persistence]**
- [T1098.005 - Account Manipulation: Device Registration]
## Functionality
### Core Capabilities
- **AiTM Proxying:** Intercepts authentication traffic between the victim and the legitimate service provider to capture session cookies.
- **Token Replay:** Enables attackers to use stolen tokens to impersonate victims and gain full account access.
- **Management Console:** A centralized dashboard built on Python Flask (using Flask-WTF) that allows operators to monitor live sessions, view statistics, and export stolen credentials.
- **Evasion Techniques:** Uses a multi-stage redirect chain (e.g., Monday.com tracking links and compromised Joomla sites) to hide the final phishing destination from reputation scanners.
### Advanced Features
- **Cloudflare Turnstile Integration:** Uses CAPTCHA-like challenges to thwart automated security scanners and analysis bots.
- **Rogue Device Registration:** Following initial access, the tool facilitates enrolling unauthorized hosts into Microsoft Entra ID.
- **Credential Binding:** Capable of binding Windows Hello for Business (WHfB) key credentials to the compromised account for long-term persistence that survives password resets.
- **Automated Webmail Access:** Features built-in functionality for auto-refreshing webmail access once a session is established.
## Indicators of Compromise
- **Network Indicators:**
- `104.37.188[.]94` (Console Hosting/Token Replay IP)
- Various domains utilizing the `.vu` TLD (Top-Level Domain)
- **Behavioral Indicators:**
- Login attempts originating from IP addresses associated with known hosting providers rather than residential ISPs.
- Unexpected registration of new devices in Microsoft Entra ID (formerly Azure AD).
- Addition of new Windows Hello for Business keys or MFA methods to user profiles.
## Associated Threat Actors
- Currently unattributed (Generic cybercriminal usage). Similar in operation to groups using kits like **EvilTokens** or **Kali365**.
## Detection Methods
- **Behavioral Detection:** Monitor for "impossible travel" alerts and logins involving session tokens that originated from different geographic locations or ASN types (e.g., a token generated on a home IP but used on a VPS IP).
- **Entra ID Monitoring:** Audit logs for `Add device` and `Add device registered owner` operations, especially those not initiated by IT staff.
- **Traffic Analysis:** Inspect for unusual redirect chains involving platforms like Monday.com or compromised CMS platforms (Joomla/WordPress) leading to login pages.
## Mitigation Strategies
- **Phishing-Resistant MFA:** Implement FIDO2-based security keys or Windows Hello for Business (properly managed) to prevent AiTM kits from intercepting authentication factors.
- **Conditional Access Policies:** Restrict logins to compliant or hybrid-joined devices only, which prevents stolen tokens from being used on unauthorized attacker machines.
- **Session Lifetime Management:** Reduce the duration of active sessions to minimize the window of opportunity for token replay.
## Related Tools/Techniques
- **EvilTokens:** A similar kit focusing on session token theft.
- **Kali365:** A kit specializing in M365 token theft and device code phishing.
- **Adversary-in-the-Middle (AiTM):** The underlying technique used by proxy-based phishing frameworks like Muraena or Evilginx2.