One approach, explained by the researchers, is what was used by DEV-0928, another threat actor tracked by Microsoft. The phishing kits have been used with several approaches. In an adversary-in-the-middle phishing attack, a bad actor intercepts and modifies communications between two parties, typically a user and a website or service, to steal sensitive or financial information, such as login credentials and credit card data.Īn AitM campaign is more difficult to detect than other types of phishing attacks because it doesn’t rely on a spoofed email or website. What is an adversary-in-the-middle phishing attack? What is an adversary-in-the-middle phishing attack?.After there is enough data and high confidence about the origin or identity of the threat actor, it is given a real threat actor name. Microsoft uses DEV followed by a number as a temporary name for an unknown, emerging or developing cluster of threat activity.

SEE: Phishing attacks: A guide for IT pros (free PDF) (TechRepublic) New research from Microsoft’s Threat Intelligence team exposed the activities of a threat actor named DEV-1101, which started advertising for an open-source phishing kit to deploy an adversary-in-the-middle campaign.Īccording to Microsoft, the threat actor described the kit as a phishing application with “reverse-proxy capabilities, automated setup, detection evasion through an antibot database, management of phishing activity through Telegram bots, and a wide range of ready-made phishing pages mimicking services such as Microsoft Office or Outlook.” Learn how to protect your business from this AitM campaign. Microsoft has already seen millions of phishing emails sent every day by attackers using this phishing kit. Massive adversary-in-the-middle phishing campaign bypasses MFA and mimics Microsoft Office

Adobe rush price