We are fighting phishing at the wrong layer
A researcher argues phishing defense should hunt shared AiTM servers that leak their origin via cookies.
A CSO Online essay argues that blocking phishing domains is ineffective because an attacker can register, certificate, and serve a credential-harvesting site in under 24 minutes. The author focuses on adversary-in-the-middle kits that proxy Microsoft's real sign-in, capture passwords and session tokens, and hide origins behind CDNs and hostname checks. Microsoft has documented one campaign of this type reaching more than 10,000 organizations. A cookie the proxy forwarded unchanged revealed the relay server's IP, which mapped dozens of lookalike domains impersonating manufacturers, staffing agencies, and waste haulers.
- A live credential-harvesting domain can be ready in under 24 minutes.
- Modern kits proxy real Microsoft sign-in and steal session tokens.
- Microsoft documented one such campaign hitting over 10,000 organizations.
- A relayed cookie exposed the attacker's origin server IP address.
- Shared hosting linked dozens of lookalike domains across separate tenants.
- Vendors
- Microsoft
- Products
- Microsoft sign-in
- Organizations
- Microsoft
From the original article
6 min read at csoonline.com
I timed an attacker once. From registering a domain to having it delegated, certificated and serving a live credential-harvesting page took under 24 minutes, and 12 of those were spent waiting on nameservers. I keep coming back to that number, because it quietly indicts most of what we do about phishing.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.