CodeStorm AiTM Kit Targets Microsoft 365, Steals MFA and Session Tokens
Summary
Hexastrike details CodeStorm, an ongoing Microsoft 365 AiTM phishing campaign linked with moderate confidence to Storm-1167. The kit intercepts credentials, MFA and session material; over 100 tenant compromises were confirmed in incident-response telemetry.
Key points
- CodeStorm uses email links, PDF and HTML lures, QR codes, and trusted SaaS redirectors to lead victims to phishing pages.
- The kit proxies Microsoft 365 sign-ins in real time to capture passwords, multiple MFA types, and authenticated session material.
- Hexastrike linked the activity to more than 100 confirmed tenant compromises and identified about 600 organizations as targets; targeting was concentrated in North America and Europe.
- The operator infrastructure included at least 400 apex domains and approximately 12,000 subdomains. Second-stage JavaScript was hosted on Tencent Cloud Object Storage.
- Anti-analysis measures include Cloudflare Turnstile gating, obfuscated JavaScript, developer-tool blocking, and checks for automation and debugging.
- Post-compromise activity included token reuse, Outlook inbox rules to hide messages, SharePoint reconnaissance, and further phishing from compromised accounts.
- Hexastrike assesses with moderate confidence that CodeStorm overlaps with Microsoft-tracked Storm-1167 activity; the campaign has been active since at least January 2025 and remains ongoing.
Article Details
- Attack Vectors
- Emails from compromised Microsoft 365 mailboxes, including trusted business partners, linked directly to credential-harvesting pages.
- Organization-branded PDF lures staged through legitimate third-party platforms redirected recipients to phishing infrastructure; some used QR codes or link shorteners.
- HTML email attachments rendered credential-harvesting interfaces when opened locally.
- A real-time authentication proxy captured passwords and multiple MFA challenge types, obtaining authenticated session cookies and tokens.
- Compromised accounts supported onward phishing to internal recipients and external contacts, including SharePoint documents and shared OneNote notebooks containing lure links.
- Defensive Notes
- Prioritize phishing-resistant authentication for high-risk users and prevent fallback to SMS, email OTP, or push approval.
- Require compliant or managed devices for sensitive applications and combine identity risk, device compliance, location, and application sensitivity in access policies.
- Revoke active sessions and cookies in addition to resetting passwords after compromise.
- Correlate anomalous sign-ins and token reuse with outbound-mail bursts, new SharePoint links, and inbox-rule changes.
- Investigate rules named LinkedIn that move phishing-related messages into RSS Feeds and mark them read.
- Monitor five-character alphanumeric lure paths, /google.php and /next.php harvester paths, and the reported payload-hosting account patterns.
- Do not rely on sender reputation or the apparent legitimacy of intermediate SaaS domains; reconstruct redirect chains to their final destinations.
- Use Continuous Access Evaluation where supported; the article cautions that Token Protection does not provide complete coverage for browser-based AiTM phishing.
- Turnstile sitekeys recurring across lure subdomains can provide per-operator infrastructure pivots.
- Apex-root probing may miss deployments because kit content requires tokenized paths and session context.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | advantagedigitalstrength[.]de | CodeStorm phishing apex domain. |
| DOMAIN | afemalesewedblessings[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | ancientexplorer[.]de | CodeStorm phishing apex domain. |
| DOMAIN | apptoimprovesecurity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | astronautosogni[.]de | CodeStorm phishing apex domain. |
| DOMAIN | astronomy[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | awomanknitaspirations[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | bell[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | bending[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | blooming[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | blossom[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | breathlessness[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | builtinlayers[.]de | CodeStorm phishing apex domain. |
| DOMAIN | caringprecision[.]de | CodeStorm phishing apex domain. |
| DOMAIN | cephalexinv[.]de | CodeStorm phishing apex domain. |
| DOMAIN | certifiedconnect[.]de | CodeStorm phishing apex domain. |
| DOMAIN | childrenreadclouds[.]de | CodeStorm phishing apex domain. |
| DOMAIN | chiminghour[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clarityfirstdigital[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clarityinbranding[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clarityindesign[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clearbrandmessage[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clearcommunicationhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clearconceptsdesign[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clearinterfacedesign[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clearlayout[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clearmodern[.]de | CodeStorm phishing apex domain. |
| DOMAIN | clickconfidence[.]de | CodeStorm phishing apex domain. |
| DOMAIN | codeforsecurity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | colorfullandscapetrain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | confidencehub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | confidenceinbuild[.]de | CodeStorm phishing apex domain. |
| DOMAIN | confidenceindetail[.]de | CodeStorm phishing apex domain. |
| DOMAIN | confidencesphere[.]de | CodeStorm phishing apex domain. |
| DOMAIN | confidentlyexecuted[.]de | CodeStorm phishing apex domain. |
| DOMAIN | consistentcollaborators[.]de | CodeStorm phishing apex domain. |
| DOMAIN | consistenthostingsolutions[.]de | CodeStorm phishing apex domain. |
| DOMAIN | consistentlystructured[.]de | CodeStorm phishing apex domain. |
| DOMAIN | contemplative[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | correspondence[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | counteddown[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | createsdependability[.]de | CodeStorm phishing apex domain. |
| DOMAIN | creations[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | credbilityandidentity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | credibilityhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | credibilityprotected[.]de | CodeStorm phishing apex domain. |
| DOMAIN | crediblemarketsignals[.]de | CodeStorm phishing apex domain. |
| DOMAIN | crediblesecure[.]de | CodeStorm phishing apex domain. |
| DOMAIN | crystalharbor[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | curated[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | current[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | curved[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | customersafenet[.]de | CodeStorm phishing apex domain. |
| DOMAIN | cyberprofessionalism[.]de | CodeStorm phishing apex domain. |
| DOMAIN | daybreak[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | definedarchitecture[.]de | CodeStorm phishing apex domain. |
| DOMAIN | delivered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | dependablecreativity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | dependableinnovations[.]de | CodeStorm phishing apex domain. |
| DOMAIN | designreducesuncertainty[.]de | CodeStorm phishing apex domain. |
| DOMAIN | designyourpeace[.]de | CodeStorm phishing apex domain. |
| DOMAIN | detail-oriented[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalbrandclarity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalconduct[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalcredibilityhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitaleffectiveness[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalforceadvantage[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalframeworksforsuccess[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitallyempowered[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitallygerman[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalmarkettransparency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalpresenceexpert[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalproficiency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalreputationclarity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalstrengthhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitalsuccessframeworks[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitaltrustbase[.]de | CodeStorm phishing apex domain. |
| DOMAIN | digitaltrustlayer[.]de | CodeStorm phishing apex domain. |
| DOMAIN | diligentdomain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | disappeared[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | domainfoundation[.]de | CodeStorm phishing apex domain. |
| DOMAIN | domaintrustlayer[.]de | CodeStorm phishing apex domain. |
| DOMAIN | dreamscapes[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | dreamsintheframe[.]de | CodeStorm phishing apex domain. |
| DOMAIN | dreamycloudletters[.]de | CodeStorm phishing apex domain. |
| DOMAIN | dynamicgrowthsystems[.]de | CodeStorm phishing apex domain. |
| DOMAIN | echoednostalgia[.]de | CodeStorm phishing apex domain. |
| DOMAIN | echoesoftheevening[.]de | CodeStorm phishing apex domain. |
| DOMAIN | ecofriendlycommunication[.]de | CodeStorm phishing apex domain. |
| DOMAIN | efficiencyworks[.]de | CodeStorm phishing apex domain. |
| DOMAIN | efficientlycompetitive[.]de | CodeStorm phishing apex domain. |
| DOMAIN | effortlessdesignclarity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | elevatebrandimage[.]de | CodeStorm phishing apex domain. |
| DOMAIN | embodied[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | encapsulated[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | encouraged[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | enlightenment[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | envelope[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | etched[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | eurotrustsignals[.]de | CodeStorm phishing apex domain. |
| DOMAIN | evoked[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | exactbusiness[.]de | CodeStorm phishing apex domain. |
| DOMAIN | exactwebpresence[.]de | CodeStorm phishing apex domain. |
| DOMAIN | executionwithconfidence[.]de | CodeStorm phishing apex domain. |
| DOMAIN | exemplaryexecution[.]de | CodeStorm phishing apex domain. |
| DOMAIN | exploring[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | extensioneurope[.]de | CodeStorm phishing apex domain. |
| DOMAIN | faintly[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | fantasies[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | fierce[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | findingtheearth[.]de | CodeStorm phishing apex domain. |
| DOMAIN | firelight[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | flawlessoperations[.]de | CodeStorm phishing apex domain. |
| DOMAIN | fondness[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | fostered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | fosteringtrust[.]de | CodeStorm phishing apex domain. |
| DOMAIN | foundationforprofessionals[.]de | CodeStorm phishing apex domain. |
| DOMAIN | foundationofprofessionals[.]de | CodeStorm phishing apex domain. |
| DOMAIN | fracturedmoon[.]de | CodeStorm phishing apex domain. |
| DOMAIN | frameworksforsuccess[.]de | CodeStorm phishing apex domain. |
| DOMAIN | friendlystray[.]de | CodeStorm phishing apex domain. |
| DOMAIN | futurereadyinfrastructure[.]de | CodeStorm phishing apex domain. |
| DOMAIN | futures[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | germanidentityhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | girlwithanotebook[.]de | CodeStorm phishing apex domain. |
| DOMAIN | glimmeringreflections[.]de | CodeStorm phishing apex domain. |
| DOMAIN | glinting[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | glisten[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | globalpreparedness[.]de | CodeStorm phishing apex domain. |
| DOMAIN | goalorientedhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | gradualquality[.]de | CodeStorm phishing apex domain. |
| DOMAIN | gurgled[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | halo[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | happycloudmessages[.]de | CodeStorm phishing apex domain. |
| DOMAIN | healing[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | heavensentrain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | heavyraindaily[.]de | CodeStorm phishing apex domain. |
| DOMAIN | heeding[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | hints[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | hopped[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | identityestablished[.]de | CodeStorm phishing apex domain. |
| DOMAIN | identityprofessional[.]de | CodeStorm phishing apex domain. |
| DOMAIN | incandescence[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | infrastructureplus[.]de | CodeStorm phishing apex domain. |
| DOMAIN | innovatestructure[.]de | CodeStorm phishing apex domain. |
| DOMAIN | innovativewege[.]de | CodeStorm phishing apex domain. |
| DOMAIN | inquisitive[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | instinctivecredibility[.]de | CodeStorm phishing apex domain. |
| DOMAIN | integratedbranding[.]de | CodeStorm phishing apex domain. |
| DOMAIN | intent[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | intentfocusgroup[.]de | CodeStorm phishing apex domain. |
| DOMAIN | intentionalmarketgroup[.]de | CodeStorm phishing apex domain. |
| DOMAIN | interlaced[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | intermittent[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | internationalreadiness[.]de | CodeStorm phishing apex domain. |
| DOMAIN | intuitiveplatform[.]de | CodeStorm phishing apex domain. |
| DOMAIN | invigorated[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | joviality[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | justkeepgoing[.]de | CodeStorm phishing apex domain. |
| DOMAIN | kept[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | lamented[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | lasted[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | lastingtrustsecure[.]de | CodeStorm phishing apex domain. |
| DOMAIN | lavender[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | leading[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | lifesaverapp[.]de | CodeStorm phishing apex domain. |
| DOMAIN | liveliness[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | localtrustworldwide[.]de | CodeStorm phishing apex domain. |
| DOMAIN | longhaulconsistency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | longings[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | longtermvaluesafe[.]de | CodeStorm phishing apex domain. |
| DOMAIN | luciddesigns[.]de | CodeStorm phishing apex domain. |
| DOMAIN | lustrous[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | marketidentityconsistency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | masteringprecision[.]de | CodeStorm phishing apex domain. |
| DOMAIN | maximizevisibility[.]de | CodeStorm phishing apex domain. |
| DOMAIN | melodized[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | melted[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | mementos[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | memoriesofwishes[.]de | CodeStorm phishing apex domain. |
| DOMAIN | mended[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | merged[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | merriment[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | modernbrandclarity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | morningmelody[.]de | CodeStorm phishing apex domain. |
| DOMAIN | mountainrainreport[.]de | CodeStorm phishing apex domain. |
| DOMAIN | murmuringriver[.]de | CodeStorm phishing apex domain. |
| DOMAIN | musicalememorie[.]de | CodeStorm phishing apex domain. |
| DOMAIN | mycredibledomain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | mysticalnight[.]de | CodeStorm phishing apex domain. |
| DOMAIN | mythsoftheglade[.]de | CodeStorm phishing apex domain. |
| DOMAIN | naturesbreath[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | night[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | nighttime[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | nightwishdomain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | northernrainwatch[.]de | CodeStorm phishing apex domain. |
| DOMAIN | notebookofsecrets[.]de | CodeStorm phishing apex domain. |
| DOMAIN | officedatasolutions[.]de | CodeStorm phishing apex domain. |
| DOMAIN | onlinepresencematters[.]de | CodeStorm phishing apex domain. |
| DOMAIN | onlinesecurityapps[.]de | CodeStorm phishing apex domain. |
| DOMAIN | optimumoperations[.]de | CodeStorm phishing apex domain. |
| DOMAIN | orderlydesigns[.]de | CodeStorm phishing apex domain. |
| DOMAIN | orderlysystems[.]de | CodeStorm phishing apex domain. |
| DOMAIN | organizedenterprise[.]de | CodeStorm phishing apex domain. |
| DOMAIN | overcame[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | partnersincommunication[.]de | CodeStorm phishing apex domain. |
| DOMAIN | partnersinconsistency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | patienceintherain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | pattered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | pause[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | pearlfilledshoes[.]de | CodeStorm phishing apex domain. |
| DOMAIN | pearlsandshoes[.]de | CodeStorm phishing apex domain. |
| DOMAIN | perceive[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | perched[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | performancedelivery[.]de | CodeStorm phishing apex domain. |
| DOMAIN | performancepredictor[.]de | CodeStorm phishing apex domain. |
| DOMAIN | performancetactics[.]de | CodeStorm phishing apex domain. |
| DOMAIN | phantasmagoric[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | phosphorescence[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | platformclarity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | platformconsistency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | platformease[.]de | CodeStorm phishing apex domain. |
| DOMAIN | platformperformancehub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | playfulcloudwords[.]de | CodeStorm phishing apex domain. |
| DOMAIN | portrayed[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | possibilities[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | powerfulpresence[.]de | CodeStorm phishing apex domain. |
| DOMAIN | powerfultrustbrands[.]de | CodeStorm phishing apex domain. |
| DOMAIN | prayerfulprecipitation[.]de | CodeStorm phishing apex domain. |
| DOMAIN | precisionandreliability[.]de | CodeStorm phishing apex domain. |
| DOMAIN | precisionandtrust[.]de | CodeStorm phishing apex domain. |
| DOMAIN | primedomainauthority[.]de | CodeStorm phishing apex domain. |
| DOMAIN | proclienthub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | prodesigncertainty[.]de | CodeStorm phishing apex domain. |
| DOMAIN | professionalassurance[.]de | CodeStorm phishing apex domain. |
| DOMAIN | professionalprecision[.]de | CodeStorm phishing apex domain. |
| DOMAIN | professionalpresencenow[.]de | CodeStorm phishing apex domain. |
| DOMAIN | professionalresultsnow[.]de | CodeStorm phishing apex domain. |
| DOMAIN | progressiveplatforms[.]de | CodeStorm phishing apex domain. |
| DOMAIN | protectyourcred[.]de | CodeStorm phishing apex domain. |
| DOMAIN | purelysophisticated[.]de | CodeStorm phishing apex domain. |
| DOMAIN | purposefului[.]de | CodeStorm phishing apex domain. |
| DOMAIN | qualityclientconnect[.]de | CodeStorm phishing apex domain. |
| DOMAIN | qualitygermanbrand[.]de | CodeStorm phishing apex domain. |
| DOMAIN | quantifiableexecution[.]de | CodeStorm phishing apex domain. |
| DOMAIN | quivered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | rainydayreflections[.]de | CodeStorm phishing apex domain. |
| DOMAIN | react[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | realities[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | recognizeable[.]de | CodeStorm phishing apex domain. |
| DOMAIN | recollect[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reflective[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reflectiveriver[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reinforcesintegrity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | relayed[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reliabilityhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reliabledigitalfootprint[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reliablehostinggrowth[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reliableplatforms[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reliablevisibility[.]de | CodeStorm phishing apex domain. |
| DOMAIN | remembered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | rendered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reputationenhancer[.]de | CodeStorm phishing apex domain. |
| DOMAIN | respectusertime[.]de | CodeStorm phishing apex domain. |
| DOMAIN | rested[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | retained[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | reverberations[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | revisin[.]de | CodeStorm phishing apex domain. |
| DOMAIN | rhythmed[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | rooftopreflections[.]de | CodeStorm phishing apex domain. |
| DOMAIN | rumble[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | ruminatingbrook[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sacredraindrops[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sacredshowers[.]de | CodeStorm phishing apex domain. |
| DOMAIN | safety[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | safetyfirstsystems[.]de | CodeStorm phishing apex domain. |
| DOMAIN | saluted[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sanfte-schatten-art[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sanfteslicht[.]de | CodeStorm phishing apex domain. |
| DOMAIN | scalableinnovations[.]de | CodeStorm phishing apex domain. |
| DOMAIN | scalableplatforms[.]de | CodeStorm phishing apex domain. |
| DOMAIN | scattered[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secondsofchime[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secretsinthewind[.]de | CodeStorm phishing apex domain. |
| DOMAIN | securedigitalsuccess[.]de | CodeStorm phishing apex domain. |
| DOMAIN | securedomainreliability[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secureenvirotrust[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secureidentityonline[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secureplatforms[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secureuserguard[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secureusertrust[.]de | CodeStorm phishing apex domain. |
| DOMAIN | securewebsolution[.]de | CodeStorm phishing apex domain. |
| DOMAIN | secureyouronlinepresence[.]de | CodeStorm phishing apex domain. |
| DOMAIN | serenades[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | showcased[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sighed[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | silhouetted[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | simplicitymastered[.]de | CodeStorm phishing apex domain. |
| DOMAIN | simplisticallysophisticated[.]de | CodeStorm phishing apex domain. |
| DOMAIN | simplysophisticatedonline[.]de | CodeStorm phishing apex domain. |
| DOMAIN | skylandobservatory[.]de | CodeStorm phishing apex domain. |
| DOMAIN | skyopenedeyes[.]de | CodeStorm phishing apex domain. |
| DOMAIN | slipped[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | snoop[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | soft[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | softmorningtown[.]de | CodeStorm phishing apex domain. |
| DOMAIN | softness[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | softwhispersofnature[.]de | CodeStorm phishing apex domain. |
| DOMAIN | solidreputation[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sophisticatedsimplicity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | specters[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | splash[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stabledigitalframeworks[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stablegrowthfoundation[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stablegrowthhost[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stargazing[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stayedlit[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | steadfastpartnerships[.]de | CodeStorm phishing apex domain. |
| DOMAIN | steadystatebranding[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stellarremembrances[.]de | CodeStorm phishing apex domain. |
| DOMAIN | stooping[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strategicdigitalclarity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | straykindnessproject[.]de | CodeStorm phishing apex domain. |
| DOMAIN | streamlineduserexp[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strengthendigitalposition[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strengthensrelationships[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strengthenyourbrand[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strengthindigital[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strongframeworks[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strongscales[.]de | CodeStorm phishing apex domain. |
| DOMAIN | strongsystems[.]de | CodeStorm phishing apex domain. |
| DOMAIN | structuredperformance[.]de | CodeStorm phishing apex domain. |
| DOMAIN | structuredsuccess[.]de | CodeStorm phishing apex domain. |
| DOMAIN | structureforusability[.]de | CodeStorm phishing apex domain. |
| DOMAIN | supported[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | survived[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | suspense[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | suspension[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sustainabledialogue[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sustainablegrowthforce[.]de | CodeStorm phishing apex domain. |
| DOMAIN | sustainscalable[.]de | CodeStorm phishing apex domain. |
| DOMAIN | swaying[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | systematicperformance[.]de | CodeStorm phishing apex domain. |
| DOMAIN | talesofthemoon[.]de | CodeStorm phishing apex domain. |
| DOMAIN | thewindnames[.]de | CodeStorm phishing apex domain. |
| DOMAIN | thoroughness[.]de | CodeStorm phishing apex domain. |
| DOMAIN | thoughtfulprecision[.]de | CodeStorm phishing apex domain. |
| DOMAIN | timeinleaves[.]de | CodeStorm phishing apex domain. |
| DOMAIN | townclockannounces[.]de | CodeStorm phishing apex domain. |
| DOMAIN | traditionmeetsinnovation[.]de | CodeStorm phishing apex domain. |
| DOMAIN | traditions[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | traditionsofinnovation[.]de | CodeStorm phishing apex domain. |
| DOMAIN | transform[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | transformation[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | transparentconversations[.]de | CodeStorm phishing apex domain. |
| DOMAIN | treeofribbons[.]de | CodeStorm phishing apex domain. |
| DOMAIN | triumphed[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustabledomains[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustedbrandinsight[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trusteddesignpro[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trusteddomainhub[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustedengagement[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustedmarket[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustenvironmentsecurity[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustfostering[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustshieldplatforms[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustthroughconsistency[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustworthybranding[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustworthygrowthhost[.]de | CodeStorm phishing apex domain. |
| DOMAIN | trustydomain[.]de | CodeStorm phishing apex domain. |
| DOMAIN | under[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | understanding[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | uninterruptedops[.]de | CodeStorm phishing apex domain. |
| DOMAIN | unsurelantern[.]de | CodeStorm phishing apex domain. |
| DOMAIN | unwaveringplatform[.]de | CodeStorm phishing apex domain. |
| DOMAIN | uplifting[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | veil[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | verifieddomainspace[.]de | CodeStorm phishing apex domain. |
| DOMAIN | verifiedidentityaddress[.]de | CodeStorm phishing apex domain. |
| DOMAIN | verstndnisvoll[.]de | CodeStorm phishing apex domain. |
| DOMAIN | visibilitydriven[.]de | CodeStorm phishing apex domain. |
| DOMAIN | visiblityboost[.]de | CodeStorm phishing apex domain. |
| DOMAIN | vision[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | vitality[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | w3ll[.]store | W3LL criminal marketplace domain referenced in Sneaky 2FA authentication code, according to Sekoia. |
| DOMAIN | wander[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | watched[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | webprofessionalism[.]de | CodeStorm phishing apex domain. |
| DOMAIN | welloptimized[.]de | CodeStorm phishing apex domain. |
| DOMAIN | whimsicalclouds[.]de | CodeStorm phishing apex domain. |
| DOMAIN | whiskers[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | whisperingwater[.]de | CodeStorm phishing apex domain. |
| DOMAIN | whispersofthewind[.]de | CodeStorm phishing apex domain. |
| DOMAIN | wishful[.]com[.]de | CodeStorm phishing apex domain. |
| DOMAIN | worldwidepreparedness[.]de | CodeStorm phishing apex domain. |
| DOMAIN | xdreamgifthouse[.]de | CodeStorm phishing apex domain. |
| DOMAIN | yielded[.]com[.]de | CodeStorm phishing apex domain. |
| SHA256 | 6bea63d580071f34e8e9a3267fb0aefbc1c0d678b90c5c24e1d40f7f9abf62a2 | Recovered index-crypto-2.php render component assessed with high confidence as CodeStorm production code or a near-identical revision. |
| URL | hxxps[:]//fqgpm[.]stooping[.]com[.]de/google[.]php | Decoded CodeStorm operator credential-harvester URL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationLure pages used encrypted JavaScript envelopes, runtime string reconstruction, and obfuscated stage-two harvesting code.T1036 · MasqueradingThe malicious stage-two file was named bootstrap.min.js to blend with a legitimate Bootstrap dependency loaded earlier.T1056.003 · Web Portal CaptureA fake tenant-branded Microsoft 365 login interface captured email addresses, passwords, and MFA artifacts.T1059.007 · JavaScriptBrowser JavaScript rendered the fake login interface and drove credential harvesting and MFA interception.T1071.001 · Web ProtocolsHTTPS carried stage-two payload downloads and communication with PHP harvester endpoints, including the reported /google.php URL.T1078.004 · Cloud AccountsOperators used compromised Microsoft 365 accounts and authenticated session material to access victim tenants.T1087.003 · Email AccountOperators harvested contacts from compromised users' Outlook address books for subsequent phishing.T1114.002 · Remote Email CollectionPost-compromise telemetry included MailItemsAccessed operations against Microsoft 365 mailboxes.T1140 · Deobfuscate/Decode Files or InformationBrowser payloads decoded LCG/Caesar/XOR obfuscation or AES-256-CBC envelopes before loading harvesting logic.T1204.001 · Malicious LinkVictims opened lure links or QR-code destinations to reach the phishing interface.T1213.002 · SharepointSome operators searched SharePoint for payment- and credential-related content.T1497.001 · System ChecksThe runtime checked navigator.webdriver, PhantomJS properties, and Burp-related user-agent strings and redirected matching sessions to about:blank.T1530 · Data from Cloud StorageOperators accessed SharePoint-hosted files after tenant compromise, with FileAccessed operations observed.T1534 · Internal SpearphishingCompromised mailboxes sent phishing messages to additional recipients inside the same tenant.T1539 · Steal Web Session CookieSuccessful live authentication interception obtained Microsoft 365 session cookies issued during the web login flow.T1550.004 · Web Session CookieOperators reused stolen Microsoft 365 session cookies after successful MFA to maintain authenticated access.T1557 · Adversary-in-the-MiddleThe kit proxied live Microsoft 365 authentication to intercept passwords, MFA responses, and authenticated session material.T1564.008 · Email Hiding RulesAn Outlook rule named LinkedIn moved messages from the phishing sender into RSS Feeds and marked them read.T1566.001 · Spearphishing AttachmentOperators delivered credential-harvesting HTML attachments directly to victim inboxes.T1566.002 · Spearphishing LinkPhishing emails linked directly to harvesting pages or to hosted documents that redirected to them.T1566.003 · Spearphishing via ServiceTrusted SaaS platforms staged lures, and operators shared OneNote notebooks containing phishing links with internal and external contacts.T1583.001 · DomainsOperators used at least 400 attacker-controlled apex domains and approximately 12,000 subdomains for lure and harvester infrastructure.T1583.006 · Web ServicesOperators hosted stage-two JavaScript in Tencent COS buckets across multiple cloud account identifiers.T1586.002 · Email AccountsPreviously compromised Microsoft 365 mailboxes supplied trusted senders for subsequent phishing.T1622 · Debugger EvasionA recurring debugger statement and performance.now() timing check detected paused execution and redirected the session away from the kit.
People
Threat Actors
Storm-1167Microsoft-tracked AiTM phishing cluster; Hexastrike assesses CodeStorm overlap with moderate confidence based on infrastructure and post-compromise behavior, without proving exclusive actor control.W3LLGroup-IB reported that W3LL operated a criminal marketplace and sold an MFA-bypassing phishing kit; discussed as ecosystem and lineage context, not established as CodeStorm's operator.
Vendors
Cloudflareand keyboard shortcut handlers, persistent debugger detection loops, gating of user access through Cloudflare Turnstile challenges, and conditional session termination upon detection of analyst tools.MicrosoftHexastrike has identified an ongoing adversary-in-the-middle (AiTM) phishing campaign targeting Microsoft 365 users that leverages a previously undocumented phishing kit, tracked by Hexastrike as CodeStorm.Tencent CloudThe second-stage credential-harvesting JavaScript is hosted on Tencent Cloud Object Storage, consistent with infrastructure patterns previously associated with Storm-1167 activity.
Products
Cloudflare Turnstileand keyboard shortcut handlers, persistent debugger detection loops, gating of user access through Cloudflare Turnstile challenges, and conditional session termination upon detection of analyst tools.Conditional AccessMicrosoft’s Conditional Access authentication strengths can be used to require phishing-resistant methods such as FIDO2 security keys, Windows Hello for Business, passkeys, and certificate-based authentication.Continuous Access EvaluationEnable Continuous Access Evaluation where supported to improve enforcement after password resets, account disablement, location changes, and session revocation.Microsoft 365 Apps for EnterpriseHexastrike has identified an ongoing adversary-in-the-middle (AiTM) phishing campaign targeting Microsoft 365 users that leverages a previously undocumented phishing kit, tracked by Hexastrike as CodeStorm.Microsoft AuthenticatorAn authenticator one-time passcode entry screen (“Verify your identity”) consistent with Microsoft Authenticator OTP challenges.Microsoft Entra IDObserved CodeStorm stage-two payloads implemented multi-method MFA interception through three branch handlers, each corresponding to a distinct Microsoft Entra ID MFA challenge type.Microsoft SharePointDelivery chains used compromised Microsoft 365 accounts, PDF and HTML lures, trusted SaaS redirectors, SharePoint-hosted content, QR codes, and link shorteners.Microsoft SwayHexastrike observed this pattern across SharePoint, Microsoft Sway, allo.io, youengage.me, mixpanel.com, and gamma.app.OneNotereconnaissance against SharePoint (payment, credentials) and propagated phishing further by sharing OneNote notebooks containing CodeStorm lure links with internal and external contacts.OutlookAfter gaining mailbox access, operators sent phishing messages to other recipients within the same tenant and to external contacts harvested from the compromised user’s Outlook address book.Tencent Cloud Object StorageThe second-stage credential-harvesting JavaScript is hosted on Tencent Cloud Object Storage, consistent with infrastructure patterns previously associated with Storm-1167 activity.Token ProtectionReview Token Protection for supported native application scenarios, but do not treat it as complete coverage for browser-based AiTM phishing because Microsoft currently states browser-based applications are notWindows Hello for BusinessPrefer FIDO2 security keys, Windows Hello for Business, passkeys, or certificate-based authentication over OTP and push-based MFA for high-risk access.
Tools
Burp SuiteBecause Burp Suite does not modify the user-agent by default, the Burp user-agent check is a low-fidelity tripwire most likely to catch analysts who have explicitly configured a Burp-identifying UA.CodeStormHexastrike has identified an ongoing adversary-in-the-middle (AiTM) phishing campaign targeting Microsoft 365 users that leverages a previously undocumented phishing kit, tracked by Hexastrike as CodeStorm.FlowerStormHexastrike compared CodeStorm against four publicly documented Microsoft 365 AiTM kits with overlapping market positioning: W3LL Panel, Sneaky 2FA, FlowerStorm, and Whisper 2FA.Rockstar2FASophos reported FlowerStorm in late 2024 as a successor to Rockstar2FA with shared ancestry to the Tycoon/Rockstar lineage, including standardized use of next.php as the harvester filename.Sneaky 2FAkit family separate from previously documented phishing frameworks such as the W3LL phishing kit, Sneaky 2FA (Sekoia, 2024) and Whisper 2FA (Barracuda, 2025).W3LL PanelHexastrike compared CodeStorm against four publicly documented Microsoft 365 AiTM kits with overlapping market positioning: W3LL Panel, Sneaky 2FA, FlowerStorm, and Whisper 2FA.Whisper 2FApreviously documented phishing frameworks such as the W3LL phishing kit, Sneaky 2FA (Sekoia, 2024) and Whisper 2FA (Barracuda, 2025).
Countries
AustraliaIdentified targets in Asia, Africa, South America, and Australia confirm the campaign’s reach extends beyond its core targeting region, but these regions together account for a small fraction of the total.FranceThe United States is the largest single jurisdiction, with France, the United Kingdom, Italy, Germany, and the Netherlands as the most-affected European jurisdictions.GermanyThe United States is the largest single jurisdiction, with France, the United Kingdom, Italy, Germany, and the Netherlands as the most-affected European jurisdictions.IndonesiaThe markers are nevertheless independent of Microsoft’s 2023 Indonesia-related infrastructure observation, since one concerns source-code language artifacts and the other concerns the location of phishing infrastructureItalyThe United States is the largest single jurisdiction, with France, the United Kingdom, Italy, Germany, and the Netherlands as the most-affected European jurisdictions.NetherlandsThe United States is the largest single jurisdiction, with France, the United Kingdom, Italy, Germany, and the Netherlands as the most-affected European jurisdictions.United KingdomThe United States is the largest single jurisdiction, with France, the United Kingdom, Italy, Germany, and the Netherlands as the most-affected European jurisdictions.United StatesThe United States is the largest single jurisdiction, with France, the United Kingdom, Italy, Germany, and the Netherlands as the most-affected European jurisdictions.
Industries
construction and real estateManufacturing, construction and real estate, and healthcare and pharma together account for roughly 30 percent of identified targets.EducationThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.EnergyThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.Financial ServicesThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.government and publicThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.healthcare and pharmaManufacturing, construction and real estate, and healthcare and pharma together account for roughly 30 percent of identified targets.LegalThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.ManufacturingManufacturing, construction and real estate, and healthcare and pharma together account for roughly 30 percent of identified targets.retail and distributionThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.technology and telecomThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.TransportThe remaining share is spread thinly across more than ten additional sectors including financial services, technology and telecom, government and public, retail and distribution, energy, legal, education, and transport.