#AiTM
All CosmicBytez Labs articles tagged #AiTM, across news, security advisories, how-to guides, and projects.
- News
Fake OpenAI, SpaceX Events Used to Steal Microsoft, Google Accounts
Phishing lures posing as OpenAI, SpaceX and Anthropic events use Kali365 and VoidProxy to steal Microsoft and Google credentials and sessions, bypassing MFA.
- News
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Huntress details an AitM campaign that steals Microsoft 365 sign-in tokens and replays them, compromising 97 accounts, with rogue MFA methods and devices...
- News
Know Your Enemy: Browser-Based Attack Techniques in 2026
Six browser-native attack techniques — from AiTM phishing kits to malicious extensions — now carry the entire intrusion chain inside a single browser tab.
- News
Passkey-Themed Phishing Attacks Lead to Microsoft 365 Data Theft
ShinyHunters and Helix affiliates use fake passkey/help-desk lures with AiTM and device-code phishing to steal Microsoft 365 data.
- News
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
A $320/month AitM phishing kit rides real Docusign notification emails to relay Microsoft 365 logins and steal live session cookies.
- News
737 Chrome VPN Extensions Caught Routing Traffic Through Attacker Proxies
Socket researchers found 737 fake Chrome VPN extensions silently routing 75,000+ users through SOCKS5 proxies on port 1082, enabling full AiTM interception.
- News
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
New research from CTM360 shows that phishing campaigns targeting insurance and financial portals have moved beyond simple credential harvesting. Attackers...
- News
Misconfigured Server Exposes Three Evilginx Phishing Ops Targeting M365
An attacker's operational security mistake — leaving a Python HTTP server and .bash_history exposed on a public port — allowed researchers to uncover...
- News
Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks
Following law enforcement disruption of the Tycoon 2FA platform, threat actors are reusing its tools and techniques across a wave of new phishing kits,...
- News
Europol-Coordinated Action Dismantles Tycoon2FA — 330
An international coalition led by Europol and Microsoft has taken down Tycoon2FA, a phishing-as-a-service platform responsible for 87.5 million phishing...