Huntress Details HTML-Smuggling Phishing Technique That Could Bypass MFA
Summary
Huntress analyzed a phishing campaign using HTML smuggling to render a proxied Outlook login iframe; researchers say stolen session tokens could enable MFA bypass. The mechanism was investigated, but victim impact and tooling were not confirmed.
Key points
- On May 21, 2024, Huntress identified three newly registered suspicious domains through identity threat telemetry and traced an HTML payload to the infrastructure.
- The payload uses JavaScript to decode and inject HTML, then loads an Outlook authentication portal in an iframe fetched from attacker-controlled infrastructure.
- Researchers supplied a test username through a URL parameter and received a corresponding login page, which supported their hypothesis that the page was transparently proxied rather than a simple site clone.
- Huntress hypothesized that credentials and MFA codes entered through the proxy could yield a stolen session token and allow subsequent access without another MFA challenge; the article does not confirm victim impact.
- Huntress said it could rule out Evilginx based on differences in lure and URL patterns and keyed HTML payload files, but could not identify the tool or framework used.
- Huntress submitted takedown requests for identified infrastructure and advised caution with unexpected HTML files and verifying login domains before entering credentials.
Article Details
- Attack Vectors
- The campaign phishes victims with an HTML file. When opened locally, its JavaScript decodes and injects additional HTML and JavaScript, then loads an Outlook authentication portal in an iframe.
- The iframe retrieves the login portal through attacker-controlled infrastructure acting as a transparent proxy. The researchers hypothesize that credentials and MFA responses could be used to steal a session token and authenticate as the victim; this attack flow was not confirmed against a real victim.
- Defensive Notes
- Use caution with unexpected HTML files received by email; contact IT or security before opening them.
- Verify that a login portal is at the expected URL and domain before entering credentials.
- Huntress reported submitting takedown requests to NameCheap for identified infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rnsnno[.]pristineitems[.]pro | Described as a shady domain used to proxy a request to the Outlook Web Access endpoint. |
| DOMAIN | rnsnno[.]vcsar[.]pro | Suspicious infrastructure whose URL parameters were used to produce a login page for a supplied target username. |
| SHA256 | 18470571777ca2628747c4f39c8da39ca81d1686820b3927160560455a603e49 | Hash listed for the HTML smuggling payload associated with the phishing infrastructure. |
| URL | hxxps[:]//rnsnno[.]2398-ns[.]pro/ | URL explicitly listed as AitM/phishing infrastructure. |
| URL | hxxps[:]//rnsnno[.]kycmaxcapital[.]pro/ | URL explicitly listed as AitM/phishing infrastructure. |
| URL | hxxps[:]//rnsnno[.]szyby[.]pro/ | URL explicitly listed as AitM/phishing infrastructure and associated with the HTML payload. |
MITRE ATT&CK
T1027.006 · HTML SmugglingThe phishing HTML file uses JavaScript to decode and dynamically render content, a behavior the article identifies as HTML smuggling.T1059.007 · JavaScriptJavaScript in the local HTML file uses document.write() to render additional HTML and JavaScript and load the iframe.T1204.002 · Malicious FileThe described attack depends on the victim opening the downloaded HTML file, which renders the embedded content in a browser.T1539 · Steal Web Session CookieThe article describes the proxy as enabling theft of the victim’s web session token after login; the appendix characterizes this as session-cookie theft.T1550.004 · Web Session CookieThe described follow-on uses a stolen session token in the attacker’s browser to authenticate as the victim and bypass the MFA requirement.T1557 · Adversary-in-the-MiddleThe researchers hypothesize that attacker-controlled infrastructure transparently proxies the Outlook login traffic as an adversary-in-the-middle.
People
Vendors
Microsoftof these network callouts are made to shady domains, but include trailing URI components of legitimate Microsoft infrastructure. For example, one network request isNamecheapyou have, I’d love to hear about it: matt.kiely[@]huntresslabs.com). We submitted a takedown request to NameCheap for all identified domains. There are probably still more out there. ATT&CK matrix items and IoCs are at