# "The Procurement Trap": AiTM Phishing-as-a-Service Campaign (EvilProxy, FlowerStorm/Storm-1167, Kali365) Targeting Universities, EU/UN Agencies, and Multinational Institutions

> A single actor operating three separate adversary-in-the-middle (AiTM) phishing-as-a-service platforms — EvilProxy, FlowerStorm (Storm-1167/successor to Rockstar2FA), and Kali365 — is running procurement-themed phishing campaigns against universities, EU/UN agencies, and multinational enterprises across professional services, finance, legal, and manufacturing. The chain abuses compromised organizational email accounts to deliver RFI/bid lures, routes victims through aged compromised domains and RDGA-generated buzzword-domains gated by Cloudflare Turnstile CAPTCHA, and presents cloned Microsoft/OpenGov/ConstructConnect/European Investment Bank authentication portals to intercept credentials, MFA tokens, and session cookies in real time, defeating password- and MFA-based controls without ever cracking a password.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1593
- **ID:** TL-2026-1593
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** FlowerStorm
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Infoblox threat intelligence identified in May 2026 a coordinated phishing infrastructure cluster that traces back to a single actor operating (or reselling access to) three distinct AiTM phishing-as-a-service (PhaaS) kits: EvilProxy (active since 2022, reverse-proxy AiTM), FlowerStorm (first seen June 2024, the successor to Rockstar2FA/Storm-1575 which partially collapsed on 2024-11-11), and Kali365 (first observed April 2026, pairs OAuth device-code phishing with AiTM cookie theft against Microsoft 365, subject of an FBI IC3 PSA on 2026-05-21 and shuttered by its own operators on 2026-05-21).

The attack chain begins with phishing emails sent from already-compromised organizational Outlook accounts, using procurement-themed lures (RFIs, bid invitations, project documentation) tailored to the target's business context. Victims click through to fake file-sharing/document portals hosted on a set of aged (6+ year old) compromised domains — barifurniture[.]net, satoriestate[.]com, sohantraders[.]com, testserveren[.]com, vresortsliving[.]com — that had been dormant for roughly a decade before being repurposed with injected index.php landing pages. These initial-stage pages solicit the victim's email address (used both for targeting confirmation and for pre-filling the subsequent phishing portal), then redirect to a second tier of purpose-registered RDGA (Randomly/Repetitively-Generated Domain Algorithm) domains built from corporate buzzword combinations under .de (FlowerStorm cluster) and .com/.net (EvilProxy cluster) TLDs. These second-tier domains front either a legitimate Cloudflare Turnstile CAPTCHA or an actor-controlled CAPTCHA clone, both used as a bot/sandbox-evasion gate before serving the final AiTM proxy page.

The final stage is a cloned authentication portal — most frequently a fake Microsoft/Microsoft 365 login, but with observed brand impersonation of OpenGov, ConstructConnect, the European Investment Bank, the United Nations, and NUS Consulting Group depending on the specific lure and target vertical. Because the phishing kit operates as a true reverse proxy, the victim's credentials and completed MFA challenge are relayed live to the legitimate identity provider while the AiTM framework transparently captures the resulting authenticated session cookie (and, for the Kali365 device-code flow, a long-lived OAuth refresh token) — giving the attacker full account access without needing to defeat MFA outright. Non-targeted visitors, scanners, and automated crawlers are cloaked to benign decoy content, a defense-evasion behavior consistent with all three PhaaS families.

Targeting spans universities and higher-education institutions, EU and UN agency personnel, US state/local government users of the OpenGov procurement platform, and enterprises in professional services, finance, legal, and manufacturing across North America, Europe, and other regions with EIB/UN engagement. This campaign sits within a broader 2025-2026 trend of AiTM PhaaS proliferation: Rockstar2FA's November 2024 partial collapse fed direct growth of FlowerStorm; a related but operationally distinct Evilginx-based actor ran a parallel campaign (April-November 2025) against at least 18 US universities using 67 attacker-owned domains and TinyURL-cloaked SSO lures, underscoring how commoditized AiTM tooling has made session-cookie theft the dominant MFA-bypass technique for both APT-adjacent and lower-skill financially motivated actors alike. No CVE applies — this is a social-engineering and identity-infrastructure abuse campaign, not a software vulnerability.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.001 Domains
- T1584.001 Domains
- T1587.001 Malware
- T1585.002 Email Accounts
- T1566.002 Spearphishing Link
- T1078.004 Cloud Accounts
- T1204.001 Malicious Link
- T1098.001 Additional Cloud Credentials
- T1684.001 Impersonation
- T1036 Masquerading
- T1550.004 Web Session Cookie
- T1556.006 Multi-Factor Authentication
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1621 Multi-Factor Authentication Request Generation
- T1056.003 Web Portal Capture
- T1518.001 Security Software Discovery
- T1550.001 Application Access Token
- T1114 Email Collection
- T1090.002 External Proxy
- T1102 Web Service
- T1531 Account Access Removal

## Sources

- [The Procurement Trap: Inside an AiTM Campaign Targeting Global Institutions](https://www.infoblox.com/blog/threat-intelligence/the-procurement-trap-inside-an-aitm-campaign-targeting-global-institutions/)
- [New FlowerStorm Microsoft phishing service fills void left by Rockstar2FA](https://www.bleepingcomputer.com/news/security/new-flowerstorm-microsoft-phishing-service-fills-void-left-by-rockstar2fa/)
- [Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service](https://thehackernews.com/2024/12/rockstar2fa-collapse-fuels-expansion-of.html)
- [From Rockstar2FA to FlowerStorm: Investigating a Blooming Phishing-as-a-Service Platform](https://www.darktrace.com/blog/from-rockstar2fa-to-flowerstorm-investigating-a-blooming-phishing-as-a-service-platform)
- [Resecurity | EvilProxy Phishing-as-a-Service with MFA Bypass Emerged in Dark Web](https://www.resecurity.com/blog/article/evilproxy-phishing-as-a-service-with-mfa-bypass-emerged-in-dark-web)
- [State-of-the-art phishing: MFA bypass](https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypass/)
- [Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit - From Telegram Hype to FBI Takedown Theater](https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/)
- [Inside Kali365, a Device Code Phishing Ecosystem](https://www.huntress.com/blog/kali365-device-code-phishing-kit)
- [FBI warns of Kali365 as device code phishing soars](https://www.theregister.com/cyber-crime/2026/05/22/fbi-warns-of-kali365-as-device-code-phishing-soars/5245024)
- [Internet Crime Complaint Center (IC3) | Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens](https://www.ic3.gov/PSA/2026/PSA260521)
- [Phishing attack targets 18 US universities, bypassing MFA](https://www.scworld.com/brief/phishing-attack-targets-18-us-universities-bypassing-mfa)
- [DNS Uncovers Infrastructure Used in SSO Attacks](https://www.infoblox.com/blog/threat-intelligence/dns-uncovers-infrastructure-used-in-sso-attacks/)
- [Entra ID OAuth Device Code Phishing via AiTM (Tycoon)](https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm)
- [Tricked by trust: How OAuth and device code flows get abused](https://logpoint.com/en/blog/emerging-threats/how-oauth-and-device-code-flows-get-abused)
- [Adversary-in-the-Middle Phishing: How AiTM Bypasses MFA](https://www.startupdefense.io/blog/adversary-in-the-middle-phishing-mfa-bypass)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1593