SecuriTricks - adversary-in-the-middle

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users

An active phishing campaign has been identified targeting organizations using Microsoft 365 and Okta for single sign-on. The campaign employs modern techniques to bypass multi-factor authentication and hijack legitimate SSO flows. It uses lookalike domains to impersonate Okta authentication pages a…

phishing

credential theft

adversary-in-the-middle

Published: December 10, 2025

Downloadable IOCs: 1

Network devices compromised for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

apt

espionage

china

adversary-in-the-middle

dns hijacking

slowstepper

software update hijacking

Published: November 19, 2025

Downloadable IOCs: 4

PlushDaemon compromises network devices for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

apt

espionage

china

adversary-in-the-middle

dns hijacking

slowstepper

software update hijacking

Published: November 19, 2025

Downloadable IOCs: 7

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The at…

china

lateral movement

adversary-in-the-middle

2025-04-30

software update hijacking

Published: May 9, 2025

Downloadable IOCs: 8

HTTP Client Tools Exploitation for Account Takeover Attacks

This analysis reveals a growing trend of attackers repurposing legitimate HTTP client tools to compromise Microsoft 365 environments. The report highlights two main attack campaigns: one using Axios client with a 43% success rate in compromising user accounts, and another using Node Fetch client fo…

adversary-in-the-middle

Published: January 30, 2025

Downloadable IOCs: 6

M365 adversary-in-the-middle campaign

Field Effect researchers uncovered a previously unreported campaign leveraging the Axios user agent string to facilitate business email compromise (BEC) attacks against Microsoft 365 (M365) accounts. The threat actor utilized malicious domains impersonating M365 login pages to harvest victims' cred…

adversary-in-the-middle

Published: July 8, 2024

Downloadable IOCs: 19

Tag: adversary-in-the-middle

Attack reports

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users

Network devices compromised for adversary-in-the-middle attacks

PlushDaemon compromises network devices for adversary-in-the-middle attacks

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

HTTP Client Tools Exploitation for Account Takeover Attacks

M365 adversary-in-the-middle campaign