This threat describes an ongoing AiTM phishing campaign that targets global institutions by leveraging compromised email accounts to distribute procurement-themed phishing lures. The campaign redirects victims through fake document portals and cloned login pages to intercept MFA-protected sessions using multiple AiTM phishing kits (EvilProxy, FlowerStorm, Kali365). The attacker uses compromised aged domains with injected PHP files to host phishing infrastructure, avoiding detection by domain reputation systems. The campaign captures session tokens and cookies in real time to establish authenticated access, effectively bypassing MFA protections.

The campaign enables attackers to bypass MFA protections by intercepting session tokens and cookies in real time, potentially allowing unauthorized authenticated access to targeted organizations' systems. The use of compromised aged domains helps evade detection by domain reputation systems, increasing the likelihood of successful phishing. The targeting of universities, enterprises, and multinational institutions including EU and UN agencies indicates a broad and high-value target set, which could lead to credential theft, unauthorized access, and potential data breaches.

No official patch or fix is applicable as this is a phishing campaign leveraging social engineering and compromised domains. Organizations should increase user awareness about procurement-themed phishing lures and verify requests through independent channels. Monitoring for the listed suspicious domains and blocking them at network perimeter controls can help reduce exposure. Implementing advanced phishing detection and response solutions that can detect AiTM phishing kits may also help. Since the attacker uses compromised aged domains, organizations should be cautious with links from unexpected or dormant domains. Regular review and hardening of email account security, including anomaly detection for compromised accounts, is recommended.