AiTM Phishing Campaign Hijacks MFA Sessions Targeting EU, UN, and Universities

Threat actors have found a way to skip the hardest part of hacking: breaking authentication. Instead, they’re stealing it after it succeeds.

Security researchers Darby Wise and Nick Sundvall have uncovered a sophisticated adversary-in-the-middle (AiTM) phishing campaign targeting universities, enterprises, and multinational institutions, including EU and UN agencies.

Unlike traditional phishing that guesses passwords, this operation intercepts live authentication sessions, capturing MFA-protected tokens and cookies in real time.

AiTM Phishing Campaign Hijacks MFA

The campaign came to light in May 2026, after a contact shared a phishing email tied to a security incident. What began as a small-scale attack on a handful of employees snowballed once those accounts were compromised, allowing the actor to weaponize trusted mailboxes and distribute lures across entire organizations.

The attack starts with emails sent from legitimate, previously compromised organizational accounts, a tactic that lends the lures instant credibility.

Themes include procurement requests, bid invitations, and shared project documents, complete with fake deadlines and confidentiality warnings designed to discourage victims from double-checking.

This isn’t opportunistic spam. The targeting of procurement and contract platforms suggests the actor is after high-value business networks, not individual credentials.

Victims who click through don’t land directly on a credential-harvesting page. Instead, they’re funneled through fake document portals impersonating platforms like ConstructConnect and OpenGov, followed by CAPTCHA verification, before reaching a cloned login page spoofing Microsoft or targeted institutions like the European Investment Bank.

Each stage mimics a legitimate workflow, reducing the odds that any single step raises suspicion.

“What makes this campaign dangerous isn’t technical sophistication in the traditional sense; it’s patience. The actor isn’t trying to look flashy or urgent.

They’re trying to look boring, routine, and expected. That’s a much harder thing to defend against with technology alone,” said [Analyst Name], threat intelligence researcher.

The actor cycles between multiple AiTM phishing-as-a-service platforms, including EvilProxy, FlowerStorm/Storm-1167, and the newer Kali365 kit, which abuses device code authentication flows. This rotation provides operational resilience if one kit gets flagged.

Notably, the infrastructure relies on aged, dormant domains rather than freshly registered ones. Domains like testserveren[.]com and barifurniture[.]net sat inactive for nearly a decade before being injected with malicious PHP files in May 2026, a technique that helps evade reputation-based detection.

Figure 5. Email prompt impersonating OpenGov

Once a victim completes login and MFA, the AiTM proxy relays credentials to the real service while silently capturing session tokens. The attacker inherits an authenticated identity without ever bypassing MFA directly.

This is the core lesson: a stolen, validated session carries the same risk as a stolen password, but it doesn’t trigger the alerts organizations built to catch credential theft.

Domain reputation and URL filtering struggle against reused, aged infrastructure. But the domains still leave fingerprints, RDGA naming patterns, subdomain conventions, and infrastructure reuse, visible through passive DNS analysis long after phishing URLs expire.

As AiTM tooling becomes more accessible, DNS-based threat intelligence offers defenders a critical upstream layer, catching malicious infrastructure before a single credential is entered.