Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress researchers discovered Knight Office, a phishing kit utilizing Adversary-in-the-Middle techniques to steal Microsoft 365 session tokens. The attack chain begins with DocuSign-themed phishing emails containing redirects through Monday.com and compromised Joomla websites. Victims are directed to credential capture pages where session tokens are harvested and fed into the Knight Office console. These stolen tokens enable attackers to bypass multi-factor authentication entirely by using already-authenticated sessions. In one incident, attackers registered rogue devices in Microsoft Entra ID and bound Windows Hello for Business credentials for persistence. Analysis revealed nine phishing attacks linked to this kit over two weeks, with hundreds of related emails reported since April. The console, hosted at IP 104.37.188.94, manages at least 25 phishing domains using .vu top-level domains.
Indicators of Compromise
- domain: kleepxrnlinecorporation.vu
- domain: advancedplacyncement.vu
- domain: amstardmzsmc.vu
- domain: arandasoftzfdware.vu
- domain: avisoretentiunionllc.vu
- domain: capitalflwxinancialpartners.vu
- domain: certififiycationedge.vu
- domain: connectivnqzityltd.vu
- domain: crrbcearegroup.vu
- domain: digitaltrafwwrficsystems.vu
- domain: exceltecbusinessbwpsolutions.vu
- domain: genamewwgdiamarketing.vu
- domain: globaieflsoftinc.vu
- domain: globalmixeucbdmodetechnologyinc.vu
- domain: globalprojectspvtltd.vu
- domain: idoej.com
- domain: joinbusinessmanagementconsdjeulting.vu
- domain: kentmanqhfufacturingcompany.vu
- domain: knsinternacshtional.vu
- domain: monttmmlrustcompany.vu
- domain: mtprormtductions.vu
- domain: realestatecotblrp.vu
- domain: siottxgroup.vu
- domain: summitcapitaltrapojininggroup.vu
- domain: techcompositnkoes.vu
- domain: techromixsolutionlonsinc.vu
Inside Knight Office, a New M365 AiTM Phishing Kit
Description
Huntress researchers discovered Knight Office, a phishing kit utilizing Adversary-in-the-Middle techniques to steal Microsoft 365 session tokens. The attack chain begins with DocuSign-themed phishing emails containing redirects through Monday.com and compromised Joomla websites. Victims are directed to credential capture pages where session tokens are harvested and fed into the Knight Office console. These stolen tokens enable attackers to bypass multi-factor authentication entirely by using already-authenticated sessions. In one incident, attackers registered rogue devices in Microsoft Entra ID and bound Windows Hello for Business credentials for persistence. Analysis revealed nine phishing attacks linked to this kit over two weeks, with hundreds of related emails reported since April. The console, hosted at IP 104.37.188.94, manages at least 25 phishing domains using .vu top-level domains.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.huntress.com/blog/inside-knight-office-m365-aitm-attack"]
- Adversary
- null
- Pulse Id
- 6a9826f70dafef0cf167f596
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainkleepxrnlinecorporation.vu | — | |
domainadvancedplacyncement.vu | — | |
domainamstardmzsmc.vu | — | |
domainarandasoftzfdware.vu | — | |
domainavisoretentiunionllc.vu | — | |
domaincapitalflwxinancialpartners.vu | — | |
domaincertififiycationedge.vu | — | |
domainconnectivnqzityltd.vu | — | |
domaincrrbcearegroup.vu | — | |
domaindigitaltrafwwrficsystems.vu | — | |
domainexceltecbusinessbwpsolutions.vu | — | |
domaingenamewwgdiamarketing.vu | — | |
domainglobaieflsoftinc.vu | — | |
domainglobalmixeucbdmodetechnologyinc.vu | — | |
domainglobalprojectspvtltd.vu | — | |
domainidoej.com | — | |
domainjoinbusinessmanagementconsdjeulting.vu | — | |
domainkentmanqhfufacturingcompany.vu | — | |
domainknsinternacshtional.vu | — | |
domainmonttmmlrustcompany.vu | — | |
domainmtprormtductions.vu | — | |
domainrealestatecotblrp.vu | — | |
domainsiottxgroup.vu | — | |
domainsummitcapitaltrapojininggroup.vu | — | |
domaintechcompositnkoes.vu | — | |
domaintechromixsolutionlonsinc.vu | — |
Threat ID: 6a984d43acd9273b4973cd66
Added to database: 09/02/2026, 16:22:27 UTC
Last updated: 09/03/2026, 01:43:42 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.