AiTM Attack: How attackers breach Microsoft 365 – A sophisticated phishing kit bypasses defense mechanisms
Sekoia researchers have identified a new phishing kit, known as Adversary-in-the-Middle (AiTM) or “Sneaky Log,” which is capable of stealing both usernames and passwords, as well as the two-factor authentication (2FA) codes protecting Microsoft 365 accounts. The kit is sold as Phishing-as-a-Service (PhaaS) via a Telegram bot, with attackers utilizing hacked WordPress sites and cloud services to bypass reputation checks and standard defense measures. Furthermore, they take care to obfuscate login pages and present an “autofill” feature that provides the feel of a legitimate site, convincing users to submit their login credentials.
Sophisticated deception using Cloudflare and clever concealment: CAPTCHA defense reinforcement and hiding from security engines
The new method exploits Cloudflare’s free service, which presents visitors with a CAPTCHA page (a test to verify the visitor is not a robot). Consequently, automated software designed to scan websites for malicious content finds it difficult to identify the attack. Attackers also utilize code that changes in real-time and well-known, high-reputation websites. As a result, security systems based on domain or reputation checks do not block them. When a security tool attempts to access the fraudulent URL, it is redirected to an innocent site like Wikipedia, whereas a human user arriving at the same address encounters a fake login page.
Real-time credential harvesting and cookie theft: 2FA is not enough – attackers listen to communications
The Sneaky Log kit allows attackers to collect sensitive information and intercept session cookies in real-time, granting them full access to the account. Even if a user has two-factor authentication (2FA) enabled, attackers can bypass this protection, particularly in cases involving impersonation of a known email address. The risk is heightened for organizations based on Microsoft 365, as a temporary access or a one-time authentication is sufficient to compromise business operations.
Recommendations from IPV Security specialists:
- Focus on page behavior: Beyond reputation-based filtering tools, it is advisable to use dynamic code inspection or real-time analysis to identify suspicious behavior.
- Deploy multi-layered Endpoint protection: Install phishing detection tools at the computer level rather than just the email or network level to contend with encryption and encrypted sessions.
- Expand to Phishing-Resistant MFA (FIDO2/WebAuthn): Use stronger measures that prevent the transfer of credentials through a third party.
- Monitor new domains: Implement monitoring and discovery of malicious domains with deceptive characteristics or those that were recently registered.
In conclusion, the “Sneaky Log” attack series highlights how attackers continue to evolve and overcome existing tools by exploiting established infrastructure and CAPTCHA services as a means of concealment. Organizations relying on Microsoft 365 require advanced authentication solutions, behavioral monitoring systems, and increased user awareness, as even traditional 2FA may no longer be sufficient against phishing kits demonstrating such extreme levels of sophistication.
For further information: https://www.scworld.com/news/sneaky-log-phishing-kits-slip-by-microsoft-365-accounts