What it does. Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-adversary-in-the-middle-phishing-detection, or copy the skill folder into ~/.claude/skills/performing-adversary-in-the-middle-phishing-detection/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md

SKILL.md (verbatim)

name: performing-adversary-in-the-middle-phishing-detection
description: Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks
  that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA
  and steal session tokens, correlating Azure AD/Entra sign-in logs, SIEM alerts,
  and EDR telemetry. Use when investigating suspected MFA-bypass phishing or session
  token theft, or building detection and response playbooks against reverse-proxy
  phishing kits.
domain: cybersecurity
subdomain: phishing-defense
tags:
- aitm
- evilproxy
- evilginx
- phishing
- mfa-bypass
- session-hijacking
- reverse-proxy
- credential-theft
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566
- T1598
- T1534
- T1036
- T1003
mitre_f3:
  version: '1.1'
  tactics:
  - initial-access
  - positioning
  techniques:
  - id: T1557
    name: Adversary-in-the-Middle
    tactic: initial-access
    source: attack
  - id: T1660
    name: Phishing
    tactic: initial-access
    source: attack
  - id: F1004
    name: Access with Stolen Session Cookie
    tactic: initial-access
    source: f3
  - id: T1539
    name: Steal Web Session Cookie
    tactic: positioning
    source: attack
  - id: T1185
    name: Browser Session Hijacking
    tactic: positioning
    source: attack
  - id: F1006
    name: Account Takeover
    tactic: initial-access
    source: f3

Performing Adversary-in-the-Middle Phishing Detection

Overview

Adversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.

When to Use

• When conducting security assessments that involve performing adversary in the middle phishing detection
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Azure AD / Entra ID Conditional Access policies
• SIEM with authentication log ingestion (Azure AD sign-in logs)
• Web proxy with SSL inspection and URL categorization
• Endpoint Detection and Response (EDR) solution
• FIDO2/phishing-resistant MFA capability

Key Concepts

How AiTM Works

1. Victim receives phishing email with link to attacker-controlled domain
2. Attacker domain runs reverse proxy that mirrors legitimate login page
3. Victim enters credentials on proxied page; credentials captured in transit
4. Reverse proxy forwards credentials to real authentication service
5. MFA challenge sent to victim; victim completes MFA on proxied page
6. Attacker captures session cookie returned by legitimate service
7. Attacker replays session cookie to access victim's account without MFA

Major AiTM Kits (2025)

Kit	Type	Primary Targets	Evasion
Tycoon 2FA	PhaaS	Microsoft 365, Google	CAPTCHA, Cloudflare turnstile
EvilProxy	PhaaS	Microsoft 365, Google, Okta	Random URLs, IP rotation
Evilginx	Open-source	Any web application	Custom phishlets
Sneaky 2FA	PhaaS	Microsoft 365	Anti-bot checks
NakedPages	PhaaS	Multiple	Minimal infrastructure

Detection Indicators

• Authentication from unusual IP not matching user profile
• Session cookie reuse from different IP/device than authentication
• Login page served from non-Microsoft/non-Google infrastructure
• CDN requests to legitimate auth providers from phishing domains
• Impossible travel between authentication and session usage

Workflow

Step 1: Deploy Phishing-Resistant MFA

• Implement FIDO2 security keys or Windows Hello for Business for high-value accounts
• Configure Conditional Access to require phishing-resistant MFA for admins
• Enable certificate-based authentication where possible
• Disable SMS and voice MFA for privileged accounts
• AiTM cannot intercept FIDO2 because authentication is bound to origin domain

Step 2: Configure Conditional Access Policies

• Require compliant/managed device for sensitive application access
• Block authentication from anonymous proxies and Tor exit nodes
• Enforce token binding to limit session cookie replay
• Configure continuous access evaluation (CAE) for real-time token revocation
• Implement sign-in risk policies that require re-authentication for risky sign-ins

Step 3: Build AiTM Detection Rules

• Alert on sign-in followed by session from different IP within 10 minutes
• Detect authentication where proxy IP does not match user's expected location
• Monitor for impossible travel patterns in session usage
• Alert on inbox rules created immediately after authentication (common post-compromise)
• Detect new MFA method registration from suspicious sign-in

Step 4: Monitor Web Proxy for AiTM Infrastructure

• Log and analyze DNS queries to newly registered domains
• Detect connections to known PhaaS infrastructure IPs
• Alert on authentication page backgrounds loaded from legitimate CDNs through proxy domains
• Monitor for SSL certificates issued to domains mimicking corporate login pages
• Block access to known EvilProxy/Evilginx infrastructure via threat intelligence

Step 5: Implement Post-Compromise Detection

• Alert on mailbox forwarding rules created after suspicious authentication
• Detect OAuth app consent after AiTM sign-in
• Monitor for email sending patterns indicating BEC follow-up
• Alert on SharePoint/OneDrive mass download after session hijack
• Track lateral movement from compromised account

Tools & Resources

• Microsoft Entra ID Protection: Risk-based Conditional Access
• Azure AD Sign-in Logs: Authentication event analysis
• Okta ThreatInsight: AiTM proxy detection at IdP level
• Sekoia TDR: AiTM campaign tracking and intelligence
• Evilginx (defensive): Understanding attack mechanics for detection

Validation

• Phishing-resistant MFA blocks AiTM session capture in test scenario
• Conditional Access denies session replay from different device/IP
• SIEM alerts fire on simulated AiTM sign-in patterns
• Web proxy blocks connections to known PhaaS infrastructure
• Post-compromise rules detect inbox rule creation after suspicious auth

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

AiTM Phishing Detection Template

Phishing-Resistant MFA Deployment

User Group	MFA Method	AiTM Resistant	Status
Global Admins	FIDO2 Security Key	Yes
Privileged Admins	Windows Hello for Business	Yes
Finance/HR	FIDO2 Security Key	Yes
All Users	Microsoft Authenticator (number match)	Partial

Conditional Access Policies for AiTM Prevention

Policy	Condition	Action	Status
Require managed device	All cloud apps	Block if unmanaged
Block anonymous proxy	Sign-in risk	Block
Require phishing-resistant MFA	Admin roles	Enforce FIDO2
Token binding	Sensitive apps	Bind to device
Continuous access evaluation	Exchange/SharePoint	Enable CAE

AiTM Detection Rules

Rule	Data Source	Alert Priority
Session IP mismatch within 10min	Azure AD sign-in logs	Critical
Impossible travel	Azure AD sign-in logs	High
Inbox rule creation post-auth	Exchange audit logs	High
OAuth consent post-risky-sign-in	Azure AD audit logs	High
New MFA method from new IP	Azure AD audit logs	Medium
Connection to PhaaS infrastructure	Web proxy logs	Medium

Incident Response Contacts

Role	Name	Contact
SOC Lead
Identity Team
Email Security

references/api-reference.md (verbatim)

Adversary-in-the-Middle (AiTM) Phishing Detection - API Reference

AiTM Attack Overview

AiTM phishing uses a reverse proxy between the victim and legitimate login page to intercept session cookies in real-time, bypassing MFA. Common frameworks: Evilginx2, Modlishka, Muraena.

Attack Chain:

1. Victim clicks phishing link
2. Reverse proxy forwards request to real login page
3. Victim enters credentials and completes MFA
4. Proxy captures session cookie
5. Attacker replays session cookie from different location

Azure AD / Entra ID Sign-In Logs

Export via Microsoft Graph API

GET https://graph.microsoft.com/v1.0/auditLogs/signIns

Key Fields

Field	Type	Description
userPrincipalName	string	User email
createdDateTime	ISO-8601	Sign-in timestamp
ipAddress	string	Source IP address
location.latitude	float	Geo-location latitude
location.longitude	float	Geo-location longitude
deviceDetail.displayName	string	Device name
correlationId	string	Session correlation ID
userAgent	string	Browser user agent

Detection Methods

Impossible Travel

Calculates Haversine great-circle distance between consecutive logins. If distance / time > 900 km/h (commercial flight speed) and distance > 100km, flags as suspicious.

Suspicious Inbox Rules

AiTM attackers commonly create rules to:

• Forward emails to external address (forwardTo, redirectTo)
• Delete incoming emails (moveToDeletedItems, permanentDelete)
• Auto-read messages (markAsRead)
• Filter on keywords: invoice, payment, wire, bank, password

Token Replay Detection

Multiple IPs and devices in a short timeframe for the same user session indicates stolen session token replay.

Inbox Rules Format

[
  {
    "displayName": "rule1",
    "mailboxOwner": "user@example.com",
    "actions": {"forwardTo": [{"emailAddress": {"address": "attacker@evil.com"}}]},
    "conditions": {"subjectContains": ["invoice", "payment"]},
    "createdDateTime": "2024-01-15T10:00:00Z"
  }
]

Haversine Formula

from math import radians, cos, sin, asin, sqrt
def haversine_km(lat1, lon1, lat2, lon2):
    lat1, lon1, lat2, lon2 = map(radians, [lat1, lon1, lat2, lon2])
    dlat, dlon = lat2 - lat1, lon2 - lon1
    a = sin(dlat/2)**2 + cos(lat1) * cos(lat2) * sin(dlon/2)**2
    return 2 * 6371 * asin(sqrt(a))

Output Schema

{
  "report": "aitm_phishing_detection",
  "total_sign_ins_analyzed": 5000,
  "total_findings": 8,
  "severity_summary": {"critical": 3, "high": 5},
  "findings": [{"type": "impossible_travel", "severity": "critical"}]
}

CLI Usage

python agent.py --logs signin_logs.json --inbox-rules rules.json --output report.json

references/standards.md (verbatim)

Standards & References: AiTM Phishing Detection

MITRE ATT&CK References

• T1557: Adversary-in-the-Middle
• T1539: Steal Web Session Cookie
• T1550.004: Use Alternate Authentication Material: Web Session Cookie
• T1566.002: Phishing: Spearphishing Link
• T1114.003: Email Collection: Email Forwarding Rule
• T1098.005: Account Manipulation: Device Registration

AiTM PhaaS Landscape (2025)

• Over 1 million PhaaS attacks detected in Jan-Feb 2025 (Barracuda)
• Tycoon 2FA most prevalent followed by EvilProxy and Evilginx
• Transition from QR codes to HTML attachments and SVG files
• Average time from compromise to inbox rule creation: under 30 minutes

Detection Rule Categories

Rule	Data Source	Confidence
Session IP mismatch	Azure AD sign-in logs	High
Impossible travel	Azure AD + session logs	High
Inbox rule post-auth	Exchange audit logs	High
New MFA method post-risky-sign-in	Azure AD audit	Medium
OAuth consent post-auth	Azure AD audit	Medium
Proxy CDN pattern	Web proxy logs	Medium
New domain phishing page	DNS + CT logs	Low

Phishing-Resistant MFA Standards

• FIDO2 WebAuthn: Origin-bound authentication prevents AiTM
• Certificate-Based Auth: Client certificate bound to device
• Windows Hello for Business: Hardware-bound credential
• NIST SP 800-63B AAL3: Phishing-resistant authenticator requirement

references/workflows.md (verbatim)

Workflows: AiTM Phishing Detection

Workflow 1: AiTM Attack Detection

User clicks phishing link
  |
  v
[Reverse proxy serves mirrored login page]
  +-- Page loads assets from legitimate CDN
  +-- SSL cert issued for lookalike domain
  |
  v
[User enters credentials + completes MFA]
  |
  v
[Attacker captures session cookie]
  |
  v
[DETECTION POINTS]
  +-- Web proxy: Connection to newly registered domain
  +-- Azure AD: Sign-in from proxy IP (unfamiliar location)
  +-- Session: Cookie replay from different IP within minutes
  +-- Exchange: Inbox rule created post-authentication
  +-- Azure AD: New OAuth app consent
  |
  v
[Automated response]
  +-- Revoke all sessions for user
  +-- Require re-authentication with phishing-resistant MFA
  +-- Remove suspicious inbox rules
  +-- Revoke OAuth app consents
  +-- Block attacker IP at firewall

Workflow 2: AiTM Incident Response

AiTM compromise confirmed
  |
  v
[Immediate containment (first 30 minutes)]
  +-- Revoke all user sessions and tokens
  +-- Force password reset
  +-- Remove all inbox forwarding rules
  +-- Revoke OAuth app consents granted post-compromise
  +-- Disable compromised MFA methods
  |
  v
[Investigation (next 2-4 hours)]
  +-- Review Azure AD sign-in logs for compromise timeline
  +-- Check email sent items for BEC/phishing sent from account
  +-- Review SharePoint/OneDrive access for data exfiltration
  +-- Check for lateral movement to other accounts
  +-- Identify all affected users (same phishing campaign)
  |
  v
[Remediation]
  +-- Enroll user in phishing-resistant MFA (FIDO2)
  +-- Block phishing domain at email gateway and web proxy
  +-- Retract phishing email from all mailboxes
  +-- Update Conditional Access policies
  +-- Notify all targeted users
  |
  v
[Post-incident]
  +-- Add IOCs to threat intelligence
  +-- Create SIEM detection rules for observed TTPs
  +-- Update security awareness training
  +-- Assess FIDO2 rollout for broader user population

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.