FlowerStorm

The attacker then reuses these cookies to open authenticated sessions, bypassing MFA and gaining full visibility into Outlook mailboxes, SharePoint files, and broader Microsoft 365 resources.

Following the first wave of phishing emails, the attacker leveraged one of the newly compromised M365 accounts ... and sent a second wave of phishing emails out from the user’s email address.

This campaign begins with emails sent from compromised organizational accounts, a tactic used to lend credibility to the lures. The emails themselves are themed around professional workflows: requests for information (RFIs), formal bid invitations, and shared project documentation.

The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails.

When a recipient clicks the embedded link, they typically land on a fake document portal hosted on compromised domains such as testserveren[.]com or barifurniture[.]net.

If a victim opens this attachment in a web browser... embedded JavaScript will immediately start a complex series of events leading to a credential harvesting web page tailored to the target's environment.

If a victim opens this attachment in a web browser (the default application for .html files), embedded JavaScript will immediately start a complex series of events leading to a credential harvesting web page tailored to the target's environment.

The attacker then reuses these cookies to open authenticated sessions, bypassing MFA and gaining full visibility into Outlook mailboxes, SharePoint files, and broader Microsoft 365 resources.

Following the first wave of phishing emails, the attacker leveraged one of the newly compromised M365 accounts ... and sent a second wave of phishing emails out from the user’s email address.

The attacker then reuses these cookies to open authenticated sessions, bypassing MFA and gaining full visibility into Outlook mailboxes, SharePoint files, and broader Microsoft 365 resources.

Following the first wave of phishing emails, the attacker leveraged one of the newly compromised M365 accounts ... and sent a second wave of phishing emails out from the user’s email address.

The first layer abuses KrakVM, an open-source JavaScript virtual machine that compiles its payload into encrypted bytecode, making the malicious content invisible to tools that inspect the attachment without executing it.

The attacker then reuses these cookies to open authenticated sessions, bypassing MFA and gaining full visibility into Outlook mailboxes, SharePoint files, and broader Microsoft 365 resources.

Following the first wave of phishing emails, the attacker leveraged one of the newly compromised M365 accounts ... and sent a second wave of phishing emails out from the user’s email address.

By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...

Visitors to the URL would be routed to a counterfeit Microsoft login page. That page captured credentials and multifactor authentication tokens and sent them via an HTTP POST message to an adversary-controlled “backend server” page.

These include compromised credentials, brute-force attempts, and phishing, along with less common approaches such as trusted relationships in which privileged credentials were over-privileged, or in which access was gained by theft of an authentication token.

Since attackers are harvesting session cookies and tokens, they inherit fully authenticated identities inside Microsoft 365 rather than simply stealing passwords.

At the core of this operation is adversary in the middle phishing that turns Outlook itself into a trusted relay for Microsoft 365 session theft.

Prompts for MFA using the same JWT for session tracking... Server begins checking for MFA acceptance... MFA was accepted, response contains session cookies for authentication.

The attacker successfully replayed the stolen, unbound session token, enabling access without triggering an additional MFA prompt.

By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...

Visitors to the URL would be routed to a counterfeit Microsoft login page. That page captured credentials and multifactor authentication tokens and sent them via an HTTP POST message to an adversary-controlled “backend server” page.

At the core of this operation is adversary in the middle phishing that turns Outlook itself into a trusted relay for Microsoft 365 session theft.

The attack flow begins with an HTTP POST transmission to a C2 server stored as a URL Base64 encoded within the script... It first sends a simple do=user-check... If so, another HTTP POST sends the initial information as do=check&email=<victim_email>.

Behind the scenes, reverse proxy based kits such as EvilProxy, FlowerStorm, and Kali365 relay the credentials to the real Microsoft service while capturing the live session cookies.

There is a final call to a file bootstrap.min.js hosted on a legitimate Tencent provider, myqcloud[.]com , using a Tencent Cloud COS (Cloud Object Storage) bucket.

That page captured credentials and multifactor authentication tokens and sent them via an HTTP POST message to an adversary-controlled “backend server” page —a PHP page with a seemingly random number for its name... In this case, the same URL to send an authentication request for the target as used in communication requests to the “backend portal”—in this case, to a backend server utilizing the file “next.php”.