Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Hackers Use Procurement Phishing and AiTM Kits to Hijack MFA-Protected Microsoft 365 Sessions
Excerpt
A sophisticated phishing campaign is using procurement-themed emails and adversary-in-the-middle (AiTM) kits to steal MFA-protected Microsoft 365 sessions. Rather than breaking MFA, attackers proxy legitimate sign-in flows and capture the session cookies and tokens created after victims authenticate. The campaign reportedly targets enterprises, universities, multinational organizations, and public-sector entities through RFIs, bid invitations, and project-document lures.…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | satoriestate.com | High | Score 61/100 | First seen |
| Domain | sohantraders.com | High | Score 61/100 | First seen |
| Domain | testserveren.com | High | Score 61/100 | First seen |
| Domain | vresortsliving.com | High | Score 61/100 | First seen |
| Domain | barifurniture.net | High | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…