Knight Office

"The attack began with a DocuSign-themed email lure, followed by multiple redirects through the Monday work management platform and a compromised Joomla website."

The redirect link went through a Monday.com tracking service and sent the victim to a compromised Joomla site to conceal the final phishing landing page.

"These stolen tokens enabled attackers to access victim accounts as authenticated users without requiring passwords or bypassing multi-factor authentication (MFA)."

Because the operator used pre-validated session tokens, they could bypass authentication controls without triggering password-based detection alerts.

"The attack began with a DocuSign-themed email lure, followed by multiple redirects through the Monday work management platform and a compromised Joomla website."

The 'Review Button' prompt in the email led to a malicious link.

"These stolen tokens enabled attackers to access victim accounts as authenticated users without requiring passwords or bypassing multi-factor authentication (MFA)."

Because the operator used pre-validated session tokens, they could bypass authentication controls without triggering password-based detection alerts.

The threat actor enrolled an unauthorized host into Microsoft Entra ID, completed a rogue, attacker-controlled device registration, and bound a Windows Hello for Business key credential to the account.

"These stolen tokens enabled attackers to access victim accounts as authenticated users without requiring passwords or bypassing multi-factor authentication (MFA)."

Because the operator used pre-validated session tokens, they could bypass authentication controls without triggering password-based detection alerts.

The threat actor enrolled an unauthorized host into Microsoft Entra ID, completed a rogue, attacker-controlled device registration, and bound a Windows Hello for Business key credential to the account.

“Variants of the lure’s subject line... substitute the lowercase letter ‘l’ for ‘i’ in words such as ‘Important’ and ‘Signature’ — likely an attempt to dodge spam filters.”

"These stolen tokens enabled attackers to access victim accounts as authenticated users without requiring passwords or bypassing multi-factor authentication (MFA)."

Because the operator used pre-validated session tokens, they could bypass authentication controls without triggering password-based detection alerts.

The threat actor sets up a relay to capture valid authentication artifacts right as the victim accepts the MFA push prompt.

Captured session tokens would then be fed into the threat actor's operator console... stolen tokens [were] replayed from the data center hosting ranges.

"Victims were ultimately directed to a phishing page where their valid session tokens were captured and sent to the Knight Office console."

"During an August investigation into an Adversary-in-the-Middle (AiTM) attack... Victims were ultimately directed to a phishing page where their valid session tokens were captured and sent to the Knight Office console."

"During an August investigation into an Adversary-in-the-Middle (AiTM) attack... Victims were ultimately directed to a phishing page where their valid session tokens were captured and sent to the Knight Office console."

The campaign used trusted redirect infrastructure, compromised websites, and residential callback proxies... The callback where the token is actually issued completes via an attacker proxy server.

Threat actor potentially masks their operational servers behind trusted, valid platforms, hijacked sites, and proxy networks.