Meddler-in-the-Middle (MitM) phishing uses reverse-proxy servers to relay legitimate login pages to victims, enabling credential theft and MFA bypass. This article surveys how MitM phishing kits work, real-world campaigns targeting Microsoft, CircleCI/GitHub, and Dropbox, and defender strategies including real-time URL filtering and stronger MFA. #Evilginx2 #Dropbox
Keypoints
- MitM phishing relays the exact content of legitimate login pages to users via a proxy, making detection and visual verification harder and bypassing MFA in some cases.
- Multiple MitM kits (Evilginx2, Modlishka, Muraena, EvilnoVNC, EvilProxy) automate deployment and include features like cloaking and tokenized URLs to load the phishing content only under specific conditions.
- Phishing campaigns have moved from simple page replicas to proxy-based attacks that steal credentials and session data while presenting a legitimate-looking page.
- Real-world campaigns in mid- to late-2022 targeted major services (Microsoft 365, CircleCI, GitHub) and even Dropbox, showing broad impact.
- Attackers can persist access by stealing session cookies and creating tokens or SSH keys, enabling continued access even if credentials change.
- Defenses emphasized include verifying URLs, using password managers, adopting hardware security keys/WebAuthn, and deploying real-time phishing URL filtering to block cloaked MitM URLs.
- MitM phishing activity remains on the rise as tooling expands, with vendors predicting new kit versions (e.g., Evilginx 3.0) and related training material.
MITRE Techniques
- [T1566.002] Phishing: Spearphishing Attachment – Phishing emails prompting victims to download an attachment that leads to a MitM page. ‘The campaign sent emails to potential victims prompting them to download an important attachment.’
- [T1566.001] Phishing: Spearphishing Link – Use of tokenized URLs (lures) that must be visited to reveal the phishing content; some pages are cloaked and only load when accessed via specific HTML attachments. ‘Generates unique tokenized URLs (aka “lures”) that must be present in the URL to reveal the phishing content.’
- [T1027] Obfuscated/Compressed Files and Information – Cloaking techniques to evade content-based phishing detection. ‘Many already employ sophisticated cloaking techniques, allowing them to evade detection by traditional phishing detection systems.’
- [T1539] Steal Web Session Cookie – The MitM server captures a real session cookie enabling persistent access to the compromised account. ‘The attacker would receive a real session cookie from the legitimate site. This persistent login allows the victim to continue to browse the site apparently as normal (though still via the attacker’s web server).’
- [T1078] Valid Accounts – Attackers persist by creating tokens or SSH keys on the victim’s account to maintain access. ‘persist in their access by quickly creating personal access tokens (PATs) or adding their own SSH keys to the victim’s account.’
Indicators of Compromise
- [Domain] – phishing-related domains used in MitM campaigns – mcrsfts-passwdupdate[.]com, circle-ci[.]com, infollnes-r-us[.]co[.]uk, microsoftonlinesupport[.]cf
Read more: https://unit42.paloaltonetworks.com/meddler-phishing-attacks/