Loading story…
The Knight Office phishing-as-a-service kit is targeting Microsoft 365 and Google Workspace users with adversary-in-the-middle phishing that captures authenticated session tokens rather than passwords. The campaign sends self-spoofed DocuSign lures through redirect chains involving Monday.com tracking links and compromised Joomla sites, then presents counterfeit Microsoft device-login, SharePoint, or Teams pages. Victims who complete legitimate MFA approval can have their active sessions replayed by attackers to access their accounts.
Following account takeover, operators register rogue devices in Microsoft Entra ID and bind Windows Hello for Business passwordless key credentials to retain access. Huntress identified at least nine token-replay logins over two weeks and more than 700 matching lure emails reported since April, indicating a sustained campaign. Organizations should investigate unusual Entra device registrations and WHfB credential additions, revoke active sessions for suspected accounts, and block the identified phishing redirect infrastructure and lures.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Following session-token theft, the attackers replayed valid Microsoft 365 tokens and enrolled an unauthorized host in the victim's Microsoft Entra ID tenant. They then bound a Windows Hello for Business key credential to the compromised account, enabling passwordless persistence even if the stolen session was revoked.
On August 18, 2026, Huntress investigated an adversary-in-the-middle phishing attack against an organization and identified the operator console for the Knight Office phishing kit. The campaign used self-spoofed DocuSign lures, Monday.com redirects, compromised Joomla sites, and counterfeit Microsoft SharePoint or Teams pages to capture Microsoft 365 sessions after MFA approval.
Huntress identified at least 700 reported emails using Knight Office-related DocuSign, voicemail, document-sharing, and signature-notification lure templates since April 2026. The emails used self-spoofing and some variants substituted lowercase “l” for “i” to evade filtering.
Researchers published 25 Knight Office-associated malicious domains, infrastructure IPs 154.127.53.78 and 104.37.188.94, a Cloudflare Turnstile sitekey, a phishing-email subject pattern, and a Dsreg user-agent indicator. The report also supplied detection logic for connections involving the listed domains and IP addresses.
Huntress linked at least nine token-replay identity logins in its customer base to Knight Office infrastructure during the two weeks preceding its report. Stolen tokens were replayed from the phishing-control-panel IP address 104.37.188[.]94 and Tencent Cloud address ranges.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourceitsecurityguru.org
Open sourcehuntress.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Active phishing campaigns are using the **Jalisco** and **OmegaLord** kits to compromise Microsoft 365 accounts with techniques designed to bypass or weaken multi-factor authentication. According to ReliaQuest, Jalisco abuses the OAuth 2.0 device authorization flow by generating fresh Microsoft device codes in real time and tricking victims into authorizing attacker-controlled devices, allowing attackers to obtain OAuth tokens without directly stealing passwords. OmegaLord uses a fake PDF reader login page to harvest credentials and victims’ phone numbers, which may help attackers intercept or manipulate MFA challenges. After gaining access, attackers have been observed moving quickly through SharePoint and other SaaS platforms to locate and exfiltrate sensitive data, sometimes within minutes, and may follow with extortion threats. ReliaQuest also reported that threat actors register multiple devices to compromised Microsoft Entra ID accounts to preserve access and refresh tokens even after password resets, reflecting a broader surge in phishing-as-a-service activity tied to platforms including **EvilTokens**, **Kali365**, **Tycoon2FA**, **Venom**, and **Darcula**. Defenders are being urged to reduce Entra ID device-registration limits, disable or restrict device code authentication through Conditional Access or Okta where not needed, and audit unnecessary app registrations.
Jul 23, 2026
A widespread phishing campaign is compromising **Microsoft 365** accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked **Storm-2755** (also known as **Payroll Pirates**), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows. Reporting also shows the intrusions can progress without additional device compromise, shifting instead into **identity-plane lateral movement** inside **Entra ID** and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through **Microsoft Graph**, register a malicious Entra ID application, create a service principal, grant permissions such as `Mail.Read` and `Mail.Send`, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including **OfficeHome error 90014**, anomalous Outlook sign-ins with **Firefox** user agents, repeated `SessionID` reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Aug 10, 2026
The PREY-0058 threat cluster is targeting executives with voice-phishing calls impersonating internal IT help-desk staff. Operators direct victims to fraudulent Microsoft 365 authentication pages using adversary-in-the-middle phishing, capturing credentials, MFA approvals, and authenticated session tokens. They replay those tokens through residential proxies—frequently NodeMaven addresses selected to match the victim’s apparent geography and network profile—to bypass normal MFA protections. After gaining access, the attackers enumerate Microsoft Entra ID and SharePoint and bulk-exfiltrate information from SharePoint, OneDrive, Exchange, and Box before issuing extortion demands. The activity overlaps with tradecraft attributed to UNC6671 and potentially Cinder or Pink-linked operations. Organizations should verify unexpected IT calls through trusted channels, require managed devices and phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, restrict proxy-originated access, enable Continuous Access Evaluation, and monitor for token replay and anomalous bulk SaaS-data collection.
Sep 9, 2026