AiTM Phishing Campaign Targets Global Institutions With Procurement-Themed Lures
Summary
Researchers detail a campaign targeting universities, businesses, and international institutions with procurement-themed phishing. It uses compromised accounts, aged domains, and multiple AiTM kits to steal credentials and authenticated sessions.
Key points
- The campaign targets organizations with RFI, bid-invitation, and project-document lures, often sent from previously compromised email accounts.
- Victims are routed through fake document-download pages, email prompts, CAPTCHA steps, and cloned login portals impersonating services such as Microsoft and OpenGov.
- The operators use AiTM kits including EvilProxy, FlowerStorm/Storm-1167, and Kali365 to relay authentication in real time and capture session tokens and cookies, including from MFA-protected logins.
- Researchers found dozens of domains hosting similar fake download pages; several appear to be aged, previously dormant sites likely compromised and modified to serve phishing content.
- The infrastructure includes domains matching RDGA-style patterns associated with FlowerStorm and EvilProxy; the article lists sample domains and other indicators.
- The researchers say domain reputation and URL analysis alone may be insufficient, and highlight DNS-based intelligence as a way to identify infrastructure patterns.
Article Details
- Attack Vectors
- Procurement- and project-themed phishing emails sent from compromised organizational accounts, using fake deadlines and confidentiality language.
- Links to fake document-download pages hosted on compromised or apparently compromised aged domains, followed by email prompts, CAPTCHA stages, and cloned login portals.
- AiTM reverse-proxy phishing that relays credentials and MFA interactions to legitimate authentication services while intercepting session cookies and tokens.
- Phishing pages impersonating Microsoft, OpenGov, ConstructConnect, and targeted organizations.
- Defensive Notes
- Do not rely on MFA alone to prevent account compromise; the article describes attackers capturing authenticated sessions and reusing intercepted tokens and cookies.
- Use DNS-based threat intelligence and passive DNS analysis to detect RDGA patterns, subdomain conventions, and infrastructure reuse.
- Treat procurement or shared-document emails from compromised organizational accounts with caution, especially when they create urgency or discourage verification.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | assessmentevaluationreport[.]com | Listed as an EvilProxy phishing domain. |
| DOMAIN | barifurniture[.]net | Aged domain hosting a fake document-download page identified in the campaign. |
| DOMAIN | consistenthostinghub[.]de | Listed as a FlowerStorm/Storm-1167 domain. |
| DOMAIN | corporatetermscompliance[.]com | Listed as an EvilProxy phishing domain. |
| DOMAIN | designenhancessatisfaction[.]de | Listed as a FlowerStorm/Storm-1167 phishing domain. |
| DOMAIN | duemineral[.]uk | Listed as a Kali365 PhaaS domain. |
| DOMAIN | employeehandbookcompliance[.]com | Listed as an EvilProxy PhaaS domain. |
| DOMAIN | esignidentification[.]com | Listed as an EvilProxy PhaaS domain. |
| DOMAIN | evergreenhostingoptions[.]de | Listed as a FlowerStorm/Storm-1167 domain. |
| DOMAIN | innovativegrowthstrategy[.]de | Listed as a FlowerStorm/Storm-1167 phishing domain. |
| DOMAIN | q1evaluationperformance[.]net | Listed as an EvilProxy phishing domain. |
| DOMAIN | reliablecontinuitysolutions[.]de | Listed as a FlowerStorm/Storm-1167 phishing domain. |
| DOMAIN | satoriestate[.]com | Listed among domains likely compromised and hosting fake document-download pages. |
| DOMAIN | sohantraders[.]com | Listed among domains likely compromised and hosting fake document-download pages. |
| DOMAIN | solidhostingservices[.]de | Listed as a FlowerStorm/Storm-1167 phishing domain. |
| DOMAIN | sustainablegrowthlaunch[.]de | Listed as a FlowerStorm/Storm-1167 phishing domain. |
| DOMAIN | testserveren[.]com | Hosted fake document-download pages that redirected victims to phishing sites. |
| DOMAIN | usersatisfactionlab[.]de | Listed as a FlowerStorm/Storm-1167 phishing domain. |
| DOMAIN | vresortsliving[.]com | Listed among domains likely compromised and hosting fake document-download pages. |
| HOSTNAME | ajgroupuae[.]usersatisfactionlab[.]de | Example of a FlowerStorm phishing-page subdomain hosted on an RDGA domain. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureCloned login portals captured credentials entered by victims.T1550.004 · Web Session CookieThe actor intercepted session cookies and tokens to establish or reuse authenticated sessions.T1557 · Adversary-in-the-MiddleAiTM kits reverse-proxied authentication in real time, relaying credentials and MFA interactions while intercepting sessions.T1566.002 · Spearphishing LinkThe campaign sent phishing emails containing links to fake document-download and authentication pages.
People
Vendors
CloudflareOnce the victim enters a valid email, they are redirected to either a legitimate Cloudflare Turnstile or a generic CAPTCHA instance hosted on actor-controlled domains.MicrosoftRedacted screenshot of sample phishing emails sent to targeted victims through compromised Microsoft Outlook accounts
Products
Cloudflare TurnstileOnce the victim enters a valid email, they are redirected to either a legitimate Cloudflare Turnstile or a generic CAPTCHA instance hosted on actor-controlled domains.ConstructConnectScreenshot of a fake download page impersonating ConstructConnectMicrosoft 365Microsoft 365 credentials mainly in professional services, finance, legal, manufacturing sectorsMicrosoft OutlookRedacted screenshot of sample phishing emails sent to targeted victims through compromised Microsoft Outlook accountsOpenGovverification stages, and cloned authentication pages impersonating trusted services including Microsoft, OpenGov, and European financial institutions.
Tools
Evilginxuniversity SSO portals using Evilginx.EvilProxyThese domains are likely generated by a registered domain generation algorithm (RDGA); the domains associated with EvilProxy and FlowerStorm/Storm-1167 phishing kits follow the RDGA patterns in Table 1.FlowerStormThe campaigns described in this blog appear to be the work of a single actor who leverages multiple AiTM phishing kits, including Evilginx, FlowerStorm, and Kali365, to harvest user credentials.Kali365The campaigns described in this blog appear to be the work of a single actor who leverages multiple AiTM phishing kits, including Evilginx, FlowerStorm, and Kali365, to harvest user credentials.
Industries
EducationfinanceMicrosoft 365 credentials mainly in professional services, finance, legal, manufacturing sectorsGovernmentTo enhance legitimacy, these prompts feature branding for popular government and construction operations platforms such as OpenGov and ConstructConnect.LegalMicrosoft 365 credentials mainly in professional services, finance, legal, manufacturing sectorsManufacturingMicrosoft 365 credentials mainly in professional services, finance, legal, manufacturing sectorsProfessional ServicesMicrosoft 365 credentials mainly in professional services, finance, legal, manufacturing sectors