Knight Office AiTM Kit Steals Microsoft 365 Session Tokens and Establishes Persistent Access
Summary
Huntress traced a Microsoft 365 AiTM phishing attack to the Knight Office kit, which captured session tokens and enabled unauthorized device registration and Windows Hello credentials. Telemetry linked at least nine token-replay attacks to the kit.
Key points
- A DocuSign-style email sent victims through Monday.com tracking and a compromised Joomla site to phishing pages posing as Microsoft SharePoint or Teams.
- The phishing flow relayed authentication and captured valid session tokens after victims completed MFA, allowing attackers to access accounts without password-based login attempts.
- Attackers registered an unauthorized device in Microsoft Entra ID and bound a Windows Hello for Business key credential, enabling a later successful sign-in.
- Huntress linked at least nine token-replay logins to Knight Office over two weeks and found hundreds of reports of similar lure emails since April.
- The operator console was hosted at 104.37.188[.]94; investigators identified at least 25 .vu domains used to host phishing pages.
- Defenders should review post-MFA sign-ins from callback proxies, unfamiliar Entra device registrations, and newly added Windows Hello credentials, and remove unauthorized authentication methods.
Article Details
- Attack Vectors
- A DocuSign-style phishing email used a link and redirects through Monday.com tracking infrastructure and a compromised Joomla site to send victims to a phishing page.
- The phishing page prompted victims to enter a device authentication code and complete Microsoft sign-in and MFA, enabling interception of authenticated session tokens.
- Captured session tokens were replayed to access Microsoft 365 accounts; the attacker then registered an unauthorized device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account.
- The email used self-spoofed From, To, and Return-Path headers.
- Defensive Notes
- Detect unexpected post-MFA authentication from callback proxies and sign-ins associated with unfamiliar devices.
- Review newly registered Microsoft Entra devices and Windows Hello for Business credentials.
- Remove unauthorized authentication methods.
- Disable synchronized accounts in on-premises identity systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | advancedplacyncement[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | amstardmzsmc[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | arandasoftzfdware[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | avisoretentiunionllc[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | capitalflwxinancialpartners[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | certififiycationedge[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | connectivnqzityltd[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | crrbcearegroup[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | digitaltrafwwrficsystems[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | exceltecbusinessbwpsolutions[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | genamewwgdiamarketing[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | globaieflsoftinc[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | globalmixeucbdmodetechnologyinc[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | globalprojectspvtltd[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | idoej[.]com | Domain identified as hosting the Knight Office phishing control panel. |
| DOMAIN | joinbusinessmanagementconsdjeulting[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | kentmanqhfufacturingcompany[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | kleepxrnlinecorporation[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | knsinternacshtional[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | monttmmlrustcompany[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | mtprormtductions[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | realestatecotblrp[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | siottxgroup[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | summitcapitaltrapojininggroup[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | techcompositnkoes[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| DOMAIN | techromixsolutionlonsinc[.]vu | Phishing domain identified among infrastructure used by the campaign. |
| IPV4 | 104[.]37[.]188[.]94 | Host IP for the Knight Office phishing operator console and observed token-replay infrastructure. |
| IPV4 | 154[.]127[.]53[.]78 | IP address linked to the sender of the phishing lure email. |
MITRE ATT&CK
T1078.004 · Cloud AccountsThe actor replayed captured legitimate session tokens to access cloud accounts without password-based authentication.T1090.003 · Multi-hop ProxyThe article describes multiple routing layers, including redirects and callback proxies, used to obscure traffic origins.T1098.005 · Device RegistrationUsing a hijacked session, the actor registered an unauthorized device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account.T1111 · Multi-Factor Authentication InterceptionThe phishing relay captured authentication artifacts while the victim completed the MFA prompt.T1204.001 · Malicious LinkThe lure urged the victim to click a link to proceed to the phishing flow.T1528 · Steal Application Access TokenThe actor intercepted and harvested session tokens to gain access to the victim’s Microsoft 365 environment.T1557 · Adversary-in-the-MiddleThe AiTM phishing kit relayed authentication between the victim and the real service to capture session tokens.T1566.002 · Spearphishing LinkA phishing email lured the victim to a malicious site through a link.T1608.005 · Link TargetThe article says the actors potentially used an open direct parameter on Monday.com’s tracking service to mask the destination and route victims to staged resources on a compromised site.T1665 · Hide InfrastructureThe article describes the actors potentially masking operational servers behind trusted redirect infrastructure, compromised websites, and proxy networks.T1684.002 · Email SpoofingThe phishing email was forged to appear to come from the recipient’s own address using its From, To, and Return-Path headers.
People
Andrea HatcherNamed as an author of the Huntress investigation.Andrew BrandtNamed as an author of the Huntress investigation.Lindsey O'Donnell-WelchNamed as an author of the Huntress investigation.Rich MozeleskiAcknowledged for contributions to the investigation and writeup.Susannah MattAcknowledged for contributions to the investigation and writeup.Tanner FilipAcknowledged for contributions to the investigation and writeup.Truman KainAcknowledged for contributions to the investigation and writeup.
Vendors
Cloudflarepanel for a phishing kit called Knight Office. The dashboard includes a generic UX landing page with a Cloudflare Turnstile and self-signed TLS certificate.Microsoftvia our own internal telemetry showed that at least nine total phishing attacks on identities (a Microsoft 365 or Google Workspace user account monitored by Huntress) have been linked to this kit over the past
Products
Cloudflare Turnstilefor a phishing kit called Knight Office. The dashboard includes a generic UX landing page with a Cloudflare Turnstile and self-signed TLS certificate.Google Workspacetelemetry showed that at least nine total phishing attacks on identities (a Microsoft 365 or Google Workspace user account monitored by Huntress) have been linked to this kit over the past two weeks.Joomlaa number of redirects (including a redirect via the Monday work management platform and a compromised Joomla website).Microsoft 365via our own internal telemetry showed that at least nine total phishing attacks on identities (a Microsoft 365 or Google Workspace user account monitored by Huntress) have been linked to this kit over the past twoMicrosoft Entra IDsession tokens. After gaining initial access, the threat actor enrolled an unauthorized host into Microsoft Entra ID, completed a rogue, attacker-controlled device registration, and bound a Windows Hello for BusinessMicrosoft SharePointof the attack: Victims would be presented with a page that purports to be either a message from Microsoft Sharepoint or Teams. The page implies that there was either a document (in the case of the SharePointMicrosoft TeamsMonday.comAiTM attack: it started via a DocuSign-style phishing email with a redirect link that went through a Monday.com tracking service and sent the victim to a compromised Joomla site, as a way to conceal the finalWindows Hello for BusinessMicrosoft Entra ID, completed a rogue, attacker-controlled device registration, and bound a Windows Hello for Business (WHfB) key credential to the account.
Tools
EvilTokensKnight Office is yet another phishing kit that relies on token theft, with other phishing services like EvilTokens and Kali365 centering their services around AiTM (session tokens) and device code phishing (OAuth accessKali365is yet another phishing kit that relies on token theft, with other phishing services like EvilTokens and Kali365 centering their services around AiTM (session tokens) and device code phishing (OAuth access tokens).Knight OfficeHomeBlogInside Knight Office, a New M365 AiTM Phishing KitValidinduring the incident. A Huntress Security Operations Center (SOC) analyst searched for this IP address in Validin and found the phishing operator's management console for Knight Office. Meanwhile, inspecting the IPVirusTotalmanagement console for Knight Office. Meanwhile, inspecting the IP itself via both Validin and VirusTotal reveals at least 25 web domains with a .vu top-level domain name to host the phishing sites.