Tag: adversary-in-the-middle

3 Attack Reports | 0 Vulnerabilities

Attack reports

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The at…

lateral movement

adversary-in-the-middle

software update hijacking

Published: May 9, 2025

Downloadable IOCs: 8

HTTP Client Tools Exploitation for Account Takeover Attacks

This analysis reveals a growing trend of attackers repurposing legitimate HTTP client tools to compromise Microsoft 365 environments. The report highlights two main attack campaigns: one using Axios client with a 43% success rate in compromising user accounts, and another using Node Fetch client fo…

adversary-in-the-middle

account takeover

http client tools

Published: January 30, 2025

Downloadable IOCs: 6

M365 adversary-in-the-middle campaign

Field Effect researchers uncovered a previously unreported campaign leveraging the Axios user agent string to facilitate business email compromise (BEC) attacks against Microsoft 365 (M365) accounts. The threat actor utilized malicious domains impersonating M365 login pages to harvest victims' cred…

adversary-in-the-middle

Published: July 8, 2024

Downloadable IOCs: 19

Click here to see more Attack Reports