This threat describes an ongoing global AiTM phishing campaign leveraging compromised email accounts to distribute procurement-themed lures targeting universities, enterprises, and multinational organizations including EU and UN agencies. The attacker redirects victims through fake document portals and CAPTCHA verification, leading to cloned authentication pages impersonating trusted services. Multiple AiTM phishing kits (EvilProxy, FlowerStorm, Kali365) are rotated to intercept MFA-protected sessions in real time, capturing session tokens and cookies to establish authenticated access. Instead of using newly registered domains, the attacker compromises aged dormant domains by injecting PHP files to host phishing infrastructure, thereby evading domain reputation-based detection.

The campaign enables attackers to bypass MFA protections by intercepting session tokens and cookies in real time, allowing unauthorized authenticated access to victim accounts. This can lead to credential theft, unauthorized access to sensitive organizational resources, and potential further compromise of targeted institutions. The use of compromised aged domains helps evade detection, increasing the campaign's persistence and effectiveness.

No official patch or fix applies as this is a phishing campaign. Organizations should be aware of procurement-themed phishing lures and suspicious email activity, especially involving document portals and authentication requests. Monitoring for compromised email accounts and educating users about AiTM phishing tactics can help reduce risk. Since the attacker uses compromised aged domains, reliance on domain reputation alone is insufficient for detection. Implementing advanced phishing detection solutions and anomaly detection on authentication events is recommended.