Inside Knight Office, a New M365 AiTM Phishing Kit

Knight Office is a phishing kit discovered by Huntress researchers that targets Microsoft 365 users by stealing session tokens through AiTM techniques. The attack chain involves DocuSign-themed phishing emails that redirect victims through Monday.com and compromised Joomla websites to credential capture pages. The harvested session tokens are fed into a centralized console hosted at IP 104.37.188.94, which manages at least 25 phishing domains under the .vu TLD. Using these tokens, attackers bypass multi-factor authentication by leveraging already-authenticated sessions. In one case, attackers registered rogue devices in Microsoft Entra ID and bound Windows Hello for Business credentials to maintain persistence. Analysis identified nine related phishing attacks over two weeks and hundreds of related emails since April.

Attackers can bypass multi-factor authentication by stealing and reusing Microsoft 365 session tokens, allowing unauthorized access to victim accounts. The ability to register rogue devices and bind Windows Hello for Business credentials enables attackers to maintain persistent access. This compromises account security and potentially exposes sensitive organizational data.

No official patch or fix is applicable as this is a phishing attack leveraging stolen session tokens. Organizations should educate users about phishing risks, especially emails impersonating DocuSign and suspicious redirects. Monitoring for unauthorized device registrations in Microsoft Entra ID and unusual Windows Hello for Business bindings is recommended. Since this is not a software vulnerability, remediation focuses on user awareness and detection of suspicious account activity.