🎯 Adversary-in-the-middle

The items that name it 9

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeupas techniques2026-10-30It is written here as T1557.

  CA telemetry showed a domain-controller identity authenticating from another device, supporting NTLM relay.

• Passkeys Are Better Than Passwords. But They Are Not Enough.
  articleas techniques2026-10-30

  Listed as an attack that traditional MFA methods remain vulnerable to.

• Unboxing Phishing Kits: Huntress Examines 3 Real Kits
  articleas classification.key entities2026-10-22
• M365 Token Spray and Replay Campaign Compromises Business Email Accounts
  writeupas classification.key entities2026-10-22
• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  articleas techniques2026-09-17It is written here as Adversary-in-the-middle (AitM).

  The Gentlemen used the Responder tool to perform AitM attacks for credential capture.

• Socket: "JeetBot" Twitch Extension Steals 31,000 Users' OAuth Tokens
  writeupas techniques2026-09-12

  Extension redirects Twitch's video-playlist requests through operator-controlled proxy servers, appending the OAuth token as a query parameter (&auth=) on the redirect.

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeupas techniques2026-08-12

  All browser traffic forced through attacker-controlled SOCKS5 servers via chrome.proxy.settings, placing the threat actor in an AitM position over every destination, TLS SNI value, source IP, and plaintext HTTP content

• UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
  articleas classification.key entities2026-08-06
• 6 Months of Researching OAuth Application Attacks | Huntress
  writeupas techniques2025-02-10It is written here as Adversary-in-the-Middle (AiTM).

  Initial access technique targeted by Huntress Unwanted Access capability