SecuriTricks - adversary-in-the-middle

Inside a phishing panel

Security researchers gained direct access to Doko's Panel, a real-time phishing platform used in criminal campaigns by ShinyHunters and BlackFile groups. The investigation revealed four distinct infrastructure clusters operating independently customized variants of the tooling. Attacks combine voic…

aitm

vishing

adversary-in-the-middle

session hijacking

2026-05-11

cryptocurrency exchange targeting

doko panel

identity provider compromise

phishing panel

real-time phishing

Published: May 11, 2026

Downloadable IOCs: 5

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Tycoon2FA emerged as a prominent phishing-as-a-service platform in August 2023, enabling large-scale campaigns targeting over 500,000 organizations monthly. Developed by Storm-1747, it provided adversary-in-the-middle capabilities to bypass multifactor authentication. The kit allowed impersonation …

credential theft

adversary-in-the-middle

evasion techniques

phishing-as-a-service

tycoon2fa

2026-03-04

multifactor authentication bypass

session token interception

Published: March 4, 2026

Downloadable IOCs: 9

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users

An active phishing campaign has been identified targeting organizations using Microsoft 365 and Okta for single sign-on. The campaign employs modern techniques to bypass multi-factor authentication and hijack legitimate SSO flows. It uses lookalike domains to impersonate Okta authentication pages a…

phishing

credential theft

adversary-in-the-middle

Published: December 10, 2025

Downloadable IOCs: 1

Network devices compromised for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

apt

espionage

china

adversary-in-the-middle

dns hijacking

slowstepper

software update hijacking

Published: November 19, 2025

Downloadable IOCs: 4

PlushDaemon compromises network devices for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

apt

espionage

china

adversary-in-the-middle

dns hijacking

slowstepper

software update hijacking

Published: November 19, 2025

Downloadable IOCs: 7

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The at…

china

lateral movement

adversary-in-the-middle

2025-04-30

software update hijacking

Published: May 9, 2025

Downloadable IOCs: 8

HTTP Client Tools Exploitation for Account Takeover Attacks

This analysis reveals a growing trend of attackers repurposing legitimate HTTP client tools to compromise Microsoft 365 environments. The report highlights two main attack campaigns: one using Axios client with a 43% success rate in compromising user accounts, and another using Node Fetch client fo…

adversary-in-the-middle

Published: January 30, 2025

Downloadable IOCs: 6

M365 adversary-in-the-middle campaign

Field Effect researchers uncovered a previously unreported campaign leveraging the Axios user agent string to facilitate business email compromise (BEC) attacks against Microsoft 365 (M365) accounts. The threat actor utilized malicious domains impersonating M365 login pages to harvest victims' cred…

adversary-in-the-middle

Published: July 8, 2024

Downloadable IOCs: 19

Tag: adversary-in-the-middle

Attack reports

Inside a phishing panel

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users

Network devices compromised for adversary-in-the-middle attacks

PlushDaemon compromises network devices for adversary-in-the-middle attacks

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

HTTP Client Tools Exploitation for Account Takeover Attacks

M365 adversary-in-the-middle campaign