Full Report
Huntress CEO Kyle Hanslovan's live hack demo: modern hacker playbook, with stolen credentials, MFA bypass, and M365 token hijacking. Get defense tips, stay protected.
Analysis Summary
# Tool/Technique: Adversary-in-the-Middle (AitM) Token Theft & M365 Hijacking
## Overview
This technique involves bypassing Multi-Factor Authentication (MFA) by stealing active session tokens rather than just passwords. By using proxy-based phishing or malicious scripts (like ClickFix), attackers intercept the authentication handshake to obtain session cookies, allowing them to impersonate the user in Microsoft 365 environments without needing to solve subsequent MFA prompts.
## Technical Details
- **Type**: Technique / Attack Framework
- **Platform**: Cloud Identities (Microsoft 365, Google Workspace), Windows (via PowerShell)
- **Capabilities**: MFA Bypass, Session Hijacking, Credential Harvesting, Social Engineering.
- **First Seen**: Variations of session hijacking have existed for years; however, the "ClickFix" (PowerShell-based CAPTCHA) and "ConsentFix" variants are actively emerging in 2024-2025 playbooks.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1539 - Steal Web Session Cookie]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1204.001 - User Execution: Malicious Link]
## Functionality
### Core Capabilities
- **Session Token Theft**: Captures the HTTP session cookies generated after a successful login, allowing the attacker to bypass MFA in future sessions.
- **PowerShell Clipboard Injection (ClickFix)**: Tricking a user into clicking a "fake CAPTCHA" that copies a malicious PowerShell command to the clipboard and lures the user into executing it (e.g., via `Win+R`).
- **Dark Web Credential Integration**: Utilizes pre-stolen credentials from infostealers (e.g., from "Russian Market") to initiate the attack.
### Advanced Features
- **ConsentFix**: Exploiting OAuth application permissions to maintain long-term persistent access even if the user changes their password.
- **AiTM Proxying**: Using tools like Evilginx to act as a transparent proxy between the real M365 login page and the victim, capturing credentials and tokens in real-time.
## Indicators of Compromise
- **File Hashes**: N/A (Often fileless or memory-resident scripts).
- **File Names**: N/A.
- **Registry Keys**: Look for modifications in `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` (tracking `Win+R` usage).
- **Network Indicators**:
- Connections to unauthorized M365-mimicking domains (e.g., `sharepoint-docs-verify[.]com`).
- Access to Microsoft resources from suspicious IP addresses or known VPS providers shortly after a login event.
- **Behavioral Indicators**:
- `powershell.exe` execution involving `Get-Clipboard` or `IEX (New-Object Net.WebClient)`.
- Unusual login locations (Impossible Travel) combined with a session start that did not trigger a new MFA prompt.
## Associated Threat Actors
- General cybercriminals and Initial Access Brokers (IABs).
- Users of "Russian Market" and similar Dark Web credential stores.
## Detection Methods
- **Signature-based detection**: Detection of known malicious PowerShell stagers used in ClickFix campaigns.
- **Behavioral detection**:
- Monitoring for "Impossible Travel" alerts in Microsoft Entra ID.
- Tracking suspicious OAuth application registrations (Consent grants).
- Monitoring for PowerShell execution initiated by users via the "Run" dialog.
- **YARA rules**: Rules targeting PowerShell scripts that access the system clipboard to execute Base64 encoded strings.
## Mitigation Strategies
- **FIDO2 Security Keys**: Move toward phishing-resistant MFA (Hardware keys like YubiKeys) which cannot be proxied by AiTM tools.
- **Conditional Access Policies**: Restrict logins to compliant, managed devices or specific geographic locations.
- **User Training**: Educate users on the "ClickFix" tactic—specifically that legitimate CAPTCHAs will never ask a user to copy/paste and run a command.
- **Token Lifetime Management**: Shorten session timeouts to reduce the window of opportunity for stolen tokens.
## Related Tools/Techniques
- **Evilginx2 / EvilProxy**: Frameworks used to automate AiTM attacks.
- **Infostealers (Redline, Lumma)**: Often the source of the initial credentials used to start these attacks.
- **OAuth Consent Phishing**: A related technique to maintain persistence without needing a password.