2. Pawel Partyka: Unraveling and Countering Adversary-in-the-Middle Phishing Attacks

### Overview Pawel Partyka explores the evolving threat landscape of adversary-in-the-middle (AiTM) credential phishing and details blue-team detection, prevention, and response strategies using Microsoft Defender XDR and Entra ID. As cybercriminals shift to Phishing-as-a-Service (PaaS) models, AiTM techniques have lowered barriers to entry, enabling unsophisticated actors to bypass traditional multi-factor authentication (MFA) and steal session cookies, frequently leading to business email compromise (BEC).

### Key Topics - **Evolution of AiTM Phishing**: AiTM began gaining traction with open-source tools like Evilginx in 2017 before exploding commercially with EvilProxy in 2021, followed by NakedPages, Greatness, Caffeine, and Tycoon. Over 50% of modern phishing attacks now leverage AiTM. - **AiTM Architectures**: Two main technical architectures exist: standard reverse proxies (traffic traverses a VPS running the kit) and synchronous relays (an intermediary API and central PaaS infrastructure route requests using rotating residential proxies). - **Prevention Mechanisms**: Implementing Entra ID conditional access policies, requiring compliant devices, adopting FIDO2 passkeys, and enforcing risk-based authentication strength. - **Detection and Automatic Disruption**: Correlating endpoint network events, email signals, and identity sign-in telemetry in Defender XDR to automatically disable compromised accounts and freeze attacks before secondary actions occur.

### Technical Details - **Standard Reverse Proxy Signatures**: In kits like Evilginx, EvilProxy, and NakedPages, the victim's remote destination IP matches the IP contacting the identity provider (IdP). Evilginx signs into Office Home and may reveal the phishing URL in sign-in log referrer fields. EvilProxy targets Office 365, leaves the resource field blank, auto-clicks "Keep me signed in" to obtain persistent cookies, periodically refreshes stolen cookies using WS-Federation OAuth endpoints, and redirects to example.com. NakedPages directs to Microsoft's privacy statement and often protects kits via Cloudflare Turnstile. - **Synchronous Relay Signatures**: Kits like Tycoon, Caffeine, and Greatness use centralized backend infrastructure and residential proxies, presenting rotating IPs per sign-in attempt. Caffeine uses differing user agents across credential entry and MFA completion steps. Tycoon periodically rotates static user agents (such as updating Chrome versions or using Axios) and renders pages that block passkey selection. - **Bypassing and Enforcing Defenses**: Because attackers can downgrade MFA prompts on phishing pages to harvest non-phish-resistant methods (e.g., SMS or push notifications), organizations should configure risk-based conditional access. When Entra ID detects an unfamiliar sign-in, it can mandate FIDO2 passkeys as the exclusive allowed authentication strength. Device compliance checks also stop AiTM attacks because kits cannot satisfy device authentication. - **Automatic Attack Disruption**: Defender XDR stitches together device events (e.g., link clicks or temporary HTML attachment saves), matching outbound network connections, unfamiliar sign-in locations, and risky sender domains, achieving over 99% signal-to-noise ratio. Upon detecting AiTM, it automatically suspends or disables the user account to invalidate session token abuse.

### Takeaways While email filtering remains important, defenders must focus on identity and post-sign-in signals. Requiring compliant devices and deploying FIDO2 passkeys offer robust structural resistance against AiTM. Furthermore, tying endpoint telemetry with identity conditional access and automated attack disruption allows organizations to contain credential theft before adversaries can execute subsequent post-compromise actions.