Skip to content

Back to the catalog

Inside Knight Office, a New M365 AiTM Phishing Kit
huntress.comwriteup

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress researchers uncovered the operator console for "Knight Office," a Flask-based adversary-in-the-middle (AiTM) phishing kit used to steal Microsoft 365 session tokens via a DocuSign-themed, self-spoofed lure that routes victims through Monday.com redirects and a compromised Joomla site to a fake Microsoft device-code authentication page. After capturing tokens, the attacker registered a rogue device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the compromised account to maintain persistent, MFA-bypassing access even after token revocation. The writeup details IOCs (IPs, .vu domains, User-Agent strings), links the campaign to hundreds of reported phishing emails since April, and gives defenders concrete hunting/response steps around callback-proxy sign-ins and newly registered WHfB credentials.

TL;DR Huntress dissects "Knight Office," a Flask-based AiTM phishing-kit console used to steal M365 session tokens and plant rogue Windows Hello for Business credentials for persistent MFA-bypassing access.
Open original ↗
Document

What it is

Detailed IR writeup of an August 18, 2026 M365 AiTM incident tied to the Knight Office phishing kit (Flask + Flask-WTF, fronted by Cloudflare Turnstile). Beyond the summary, the page gives the specific fingerprints and the exact failure-then-success persistence sequence a defender can hunt on.

How it works

The lure is a device-code phishing flow, not a classic credential-relay page. The victim is handed a nine-letter deviceauth code, told to "Sign In With Microsoft," and pushed to Microsoft's real deviceauth screen where they paste the code and complete an MFA push against Microsoft Authentication Broker / OfficeHome. That hands the operator a valid session token.

Persistence sequence (the actionable part):

  1. Attacker registers a rogue device from 104.37.188[.]94.
  2. Two OAuth 2.0 token-auth attempts fail because the required NGC key (used by WHfB) isn't yet present.
  3. Attacker enrolls an unauthorized host into Entra ID and binds a WHfB key credential — observed via User-Agent Dsreg/10.0 (Windows 10.0.19044.1826).
  4. Attacker signs in successfully via WHfB passwordless — surviving token revocation.

Token replays came from datacenter ranges with User-Agent python-requests/2.34.2, OAuth2:Token. Auth logs showed zero bad-password attempts; failures were only expired tokens or missing device keys — so password-based alerting sees nothing.

Preconditions / Affected

M365 / Entra ID tenants where users can complete device-code auth and where device registration + WHfB enrollment aren't tightly gated. The post-MFA callback arrived from 73.125.13[.]x (Comcast, but flagged by Spur as a callback proxy) — the tell that a reverse proxy sat between user and IdP.

What to do

  • Hunt post-MFA authentications from callback-proxy IPs where sign-in and token-callback IPs diverge.
  • Alert on User-Agents python-requests/2.34.2, OAuth2:Token and Dsreg/10.0 device registrations.
  • Review newly registered Entra devices and WHfB/NGC key credentials; remove unauthorized auth methods.
  • Disable synchronized accounts in on-prem identity systems.
  • Lure detection: subject lines using l→i substitution (lmportant, Slgnature, VERlVIED), self-spoofed From/To/Return-Path headers, and DocuSign/SharePoint/Teams voicemail themes. Sender IP 154.127.53[.]78; ~25 .vu phishing domains on the console IP.

Caveats

The captured artifact is the operator console (login dashboard), not the kit source — victim-facing templates and capture scripts weren't obtained. The original Joomla redirect and Monday.com killchain were already dead; the landing-page reconstruction is inferred from VirusTotal-collected sibling emails, not the live incident page.

Technologies named here

Techniques named here

  • Adversary-in-the-Middle phishing
  • Session token theft / replay
  • Self-spoofing lure
  • Multi-hop redirect chain to conceal phishing landing page
  • Device Code Authentication Phishing
  • Rogue device registration / Entra ID enrollment
  • Rogue WHfB key credential binding
  • Callback proxy use for AiTM relay
  • Homoglyph/character substitution in phishing subject lines

Threat actors named here

Related in Threat Intel