Inside Knight Office, a New M365 AiTM Phishing Kit
AI summary · glm-5.3-flashSummaries by Vani AI
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.
Key facts
- Attack chain: self-spoofed DocuSign email, Monday.com redirect, compromised Joomla host, AiTM token capture.
- Post-compromise: rogue Entra ID device registration with Windows Hello for Business key credential binding.
- Console at 104.37.188.94 offers single-panel victim session, credential, and link management.
- Callback proxy IP flagged by Spur revealed the AiTM pattern via Microsoft Authentication Broker events.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | advancedplacyncement.vu | .51[.]x) and 104.37.188[.]94 Observed replay infrastructure advancedplacyncement[.]vu amstardmzsmc[.]vu arandasoftzfdware[.]vu avisoretentiunio |
| domain | amstardmzsmc.vu | 94 Observed replay infrastructure advancedplacyncement[.]vu amstardmzsmc[.]vu arandasoftzfdware[.]vu avisoretentiunionllc[.]vu capitalf |
| domain | arandasoftzfdware.vu | infrastructure advancedplacyncement[.]vu amstardmzsmc[.]vu arandasoftzfdware[.]vu avisoretentiunionllc[.]vu capitalflwxinancialpartners[.]v |
| domain | avisoretentiunionllc.vu | dplacyncement[.]vu amstardmzsmc[.]vu arandasoftzfdware[.]vu avisoretentiunionllc[.]vu capitalflwxinancialpartners[.]vu certififiycationedge[.]v |
| domain | capitalflwxinancialpartners.vu | mzsmc[.]vu arandasoftzfdware[.]vu avisoretentiunionllc[.]vu capitalflwxinancialpartners[.]vu certififiycationedge[.]vu connectivnqzityltd[.]vu crrbcea |
| domain | certififiycationedge.vu | avisoretentiunionllc[.]vu capitalflwxinancialpartners[.]vu certififiycationedge[.]vu connectivnqzityltd[.]vu crrbcearegroup[.]vu digitaltrafww |
| domain | connectivnqzityltd.vu | capitalflwxinancialpartners[.]vu certififiycationedge[.]vu connectivnqzityltd[.]vu crrbcearegroup[.]vu digitaltrafwwrficsystems[.]vu excelte |
| domain | crrbcearegroup.vu | ners[.]vu certififiycationedge[.]vu connectivnqzityltd[.]vu crrbcearegroup[.]vu digitaltrafwwrficsystems[.]vu exceltecbusinessbwpsolution |
| domain | digitaltrafwwrficsystems.vu | cationedge[.]vu connectivnqzityltd[.]vu crrbcearegroup[.]vu digitaltrafwwrficsystems[.]vu exceltecbusinessbwpsolutions[.]vu genamewwgdiamarketing[. |
| domain | exceltecbusinessbwpsolutions.vu | yltd[.]vu crrbcearegroup[.]vu digitaltrafwwrficsystems[.]vu exceltecbusinessbwpsolutions[.]vu genamewwgdiamarketing[.]vu globaieflsoftinc[.]vu globalmi |
| domain | genamewwgdiamarketing.vu | taltrafwwrficsystems[.]vu exceltecbusinessbwpsolutions[.]vu genamewwgdiamarketing[.]vu globaieflsoftinc[.]vu globalmixeucbdmodetechnologyinc[.]v |
| domain | globaieflsoftinc.vu | xceltecbusinessbwpsolutions[.]vu genamewwgdiamarketing[.]vu globaieflsoftinc[.]vu globalmixeucbdmodetechnologyinc[.]vu globalprojectspvtltd |
| domain | globalmixeucbdmodetechnologyinc.vu | tions[.]vu genamewwgdiamarketing[.]vu globaieflsoftinc[.]vu globalmixeucbdmodetechnologyinc[.]vu globalprojectspvtltd[.]vu joinbusinessmanagementconsdjeul |
| domain | globalprojectspvtltd.vu | globaieflsoftinc[.]vu globalmixeucbdmodetechnologyinc[.]vu globalprojectspvtltd[.]vu joinbusinessmanagementconsdjeulting[.]vu kentmanqhfufactu |
| domain | idoej.com | l panel host found by pivoting from the phishing page title idoej[.]com Domain of the phishing control panel host found via rever |
| domain | joinbusinessmanagementconsdjeulting.vu | balmixeucbdmodetechnologyinc[.]vu globalprojectspvtltd[.]vu joinbusinessmanagementconsdjeulting[.]vu kentmanqhfufacturingcompany[.]vu kleepxrnlinecorporation[ |
| domain | kentmanqhfufacturingcompany.vu | rojectspvtltd[.]vu joinbusinessmanagementconsdjeulting[.]vu kentmanqhfufacturingcompany[.]vu kleepxrnlinecorporation[.]vu knsinternacshtional[.]vu mon |
| domain | kleepxrnlinecorporation.vu | nagementconsdjeulting[.]vu kentmanqhfufacturingcompany[.]vu kleepxrnlinecorporation[.]vu knsinternacshtional[.]vu monttmmlrustcompany[.]vu mtprorm |
| domain | knsinternacshtional.vu | ntmanqhfufacturingcompany[.]vu kleepxrnlinecorporation[.]vu knsinternacshtional[.]vu monttmmlrustcompany[.]vu mtprormtductions[.]vu realestate |
| domain | monday.com | k the true destination by using an open direct parameter on Monday[.]com's tracking service. When clicked the link routes the vict |
| domain | monttmmlrustcompany.vu | [.]vu kleepxrnlinecorporation[.]vu knsinternacshtional[.]vu monttmmlrustcompany[.]vu mtprormtductions[.]vu realestatecotblrp[.]vu siottxgroup[ |
| domain | mtprormtductions.vu | tion[.]vu knsinternacshtional[.]vu monttmmlrustcompany[.]vu mtprormtductions[.]vu realestatecotblrp[.]vu siottxgroup[.]vu summitcapitaltrap |
| domain | realestatecotblrp.vu | htional[.]vu monttmmlrustcompany[.]vu mtprormtductions[.]vu realestatecotblrp[.]vu siottxgroup[.]vu summitcapitaltrapojininggroup[.]vu techc |
| domain | siottxgroup.vu | stcompany[.]vu mtprormtductions[.]vu realestatecotblrp[.]vu siottxgroup[.]vu summitcapitaltrapojininggroup[.]vu techcompositnkoes[.]vu |
| domain | summitcapitaltrapojininggroup.vu | prormtductions[.]vu realestatecotblrp[.]vu siottxgroup[.]vu summitcapitaltrapojininggroup[.]vu techcompositnkoes[.]vu techromixsolutionlonsinc[.]vu Phis |
| domain | techcompositnkoes.vu | rp[.]vu siottxgroup[.]vu summitcapitaltrapojininggroup[.]vu techcompositnkoes[.]vu techromixsolutionlonsinc[.]vu Phishing domains used by th |
| domain | techromixsolutionlonsinc.vu | u summitcapitaltrapojininggroup[.]vu techcompositnkoes[.]vu techromixsolutionlonsinc[.]vu Phishing domains used by the threat actors involved in th |
| ipv4 | 104.37.188.94 | this incident, Huntress telemetry picked up the IP address 104.37.188[.]94 being linked to stolen token replays during the incident. |
| ipv4 | 154.127.53.78 | tack, the initial email sender's IP linked to the email was 154.127.53[.]78 . A closer inspection of this IP address on VirusTotal sh |
From the original article
10 min read at huntress.comAn inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.