Threat reportPhishingTL-2026-1811
AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM Session Theft
AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM (TL-2026-1811), also tracked as AiTM Phishing, is a high-severity phishing campaign, first published 2026-07-29. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID, maps to 22 MITRE ATT&CK techniques (T1027, T1071, T1078), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-1811
- Threat ID
- TL-2026-1811
- Also known as
- AiTM Phishing, Adversary-in-the-Middle Session Theft, Malware-Free Session Hijacking
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, banking, professional services, cross-sector enterprise saas and cloud-identity users
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM
Malware and tooling: EvilProxy, EvilTokens, Greatness, Kali365, Kratos, Mamba 2FA, Modlishka, Muraena, Rockstar 2FA, Sneaky2FA, Tycoon 2FA, evilginx2 - S9003
How AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM works
Phishing campaigns are moving away from malware delivery toward adversary-in-the-middle (AiTM) techniques that operate entirely inside the victim's browser, using AI-crafted lures, multi-stage redirect chains, and DOM manipulation to render credential-harvesting interfaces indistinguishable from legitimate enterprise sign-in pages while stealing session tokens to bypass MFA.
Security researchers are documenting a decisive shift in phishing tradecraft: attackers are abandoning malware-based credential theft in favor of adversary-in-the-middle (AiTM) techniques that operate entirely inside the victim's browser, using AI-generated lures and dynamically rendered DOM content to make the interception layer indistinguishable from the legitimate service being spoofed.
The modern kill chain begins with a trusted-looking email or message -- increasingly authored or refined with generative AI, per ENISA's finding that AI-supported content represented over 80% of observed social-engineering activity in early 2025 -- that routes the victim through a multi-stage redirect chain, often bouncing through a legitimate SaaS platform before landing on the AiTM proxy. In Microsoft's documented Storm-1167 campaign, victims were routed through a legitimate Canva page before arriving at a Tencent-Cloud-hosted fake Microsoft sign-in page. Reverse-proxy toolkits such as Evilginx2, EvilProxy, Modlishka, and Muraena, and their commercialized Phishing-as-a-Service (PhaaS) descendants -- Tycoon 2FA (operated by Storm-1747, ~76% of PhaaS traffic), Sneaky2FA, Rockstar 2FA, Mamba 2FA, Greatness, Kratos, Kali365, and EvilTokens -- sit between the victim and the real identity provider (Microsoft 365/Entra ID, Google Workspace, Okta), relaying the login form in real time so the victim's password AND completed MFA challenge both transit the attacker's infrastructure. The proxy captures the resulting session cookie/token rather than the password alone, which is why the technique defeats password- and TOTP-based MFA without cryptographically breaking it -- it simply steals the already-authenticated session.
The DOM-manipulation layer that gives this trend its 'malware-free' character includes dynamically injected scripts, hidden form fields, fake CAPTCHA gates used to filter out security scanners and sandboxes, and anti-bot IP/User-Agent filtering, all executed client-side inside an encrypted HTTPS session -- which is why traditional network and endpoint tooling (no dropped executable, no anomalous process) misses it. Analysts (ANY.RUN, Cisco Talos) recommend recovering this visibility via in-browser SSL/TLS session-key extraction from process memory rather than certificate-replacing MITM interception.
Once a session cookie is captured, documented post-compromise behavior from Microsoft's Storm-1167 disclosure includes replaying the cookie from a new IP to sign in without a fresh MFA prompt, silently adding a secondary MFA method (a OneWaySMS number, observed with an Iranian country code) to preserve access after the original token expires, creating inbox rules to archive and mark security notifications as read, and using the compromised mailbox to launch large-scale follow-on phishing (16,000+ emails in the observed case) against the victim's own contacts -- converting a single AiTM compromise into a self-propagating BEC campaign.
Industry telemetry frames the scale of the shift: Microsoft's Digital Defense Report 2025 attributes 80% of MFA-bypass compromises to stolen session tokens and found token theft accounted for 31% of Microsoft 365 breaches; infostealers alone exposed an estimated 1.8 billion credentials and billions of session cookies in 2025, frequently targeting the Entra ID ESTSAUTHPERSISTENT persistent-session cookie specifically. AiTM incident volume is reported up 146% year-over-year with close to 40,000 daily incidents detected. FBI IC3 attributes $3.05 billion in annual losses to Business Email Compromise, the downstream monetization path for many AiTM compromises.
MITRE ATT&CK techniques used in TL-2026-1811
Defense Evasion
T1027 Obfuscated Files or Information; T1078 Valid Accounts; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service
Initial Access
T1078 Valid Accounts; T1199 Trusted Relationship; T1566 Phishing
Privilege Escalation
Persistence
T1098 Account Manipulation; T1556 Modify Authentication Process
Credential Access
T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Collection
T1114 Email Collection; T1557 Adversary-in-the-Middle
Execution
Lateral Movement
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1608 Stage Capabilities
stealth
Affected products and versions in AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM
- Microsoft — Microsoft 365 / Entra ID
Vulnerable versions: cloud tenants relying on password + replayable MFA without phishing-resistant authentication
Fixed in: N/A -- technique targets the authentication workflow, not a specific software version; mitigated via FIDO2/WebAuthn, Conditional Access, and token binding - Google — Google Workspace
Vulnerable versions: cloud tenants relying on password + replayable MFA without phishing-resistant authentication
Fixed in: N/A -- mitigated via FIDO2/WebAuthn security keys and equivalent risk-based access controls - Okta — Okta Identity Cloud
Vulnerable versions: tenants relying on password + replayable MFA without phishing-resistant authentication
Fixed in: N/A -- mitigated via phishing-resistant authentication (e.g. FastPass/WebAuthn)
Remediation for AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM
Immediate actions
- Deploy phishing-resistant authentication (FIDO2/WebAuthn security keys or passkeys) for all privileged and high-risk accounts
- Enable Conditional Access / sign-in risk policies that block authentication from unmanaged devices, anonymizer or hosting-provider IP ranges, and impossible-travel locations
- Hunt for 'stolen session cookie was used' and 'possible AiTM phishing attempt' alerts in Microsoft 365 Defender / Entra ID Identity Protection
- Revoke and force re-authentication of sessions showing simultaneous use from divergent IP/User-Agent pairs
- Audit mailbox inbox rules for auto-archive / mark-as-read rules created outside of user-initiated changes, and review recent MFA-method additions for unrecognized phone numbers or devices
Workarounds
- Restrict legacy/basic authentication protocols that do not support modern MFA challenge-response
- Disable SMS/voice OTP as a permitted MFA method where phishing-resistant alternatives are available, since AiTM kits target replayable OTP/session flows
- Enforce sign-in frequency and re-authentication prompts for high-risk applications to shrink the AiTM cookie-replay window
Longer-term hardening
- Deploy browser-level / encrypted-session visibility (in-browser SSL/TLS session-key extraction) into SOC detection stacks to see DOM manipulation and redirect chains hidden inside HTTPS
- Integrate automated YARA/IOC generation from sandboxed phishing-page analysis into SIEM/SOAR and threat-intel feeds
- Adopt token binding / continuous access evaluation so stolen session cookies cannot be replayed from a new device or location
- Implement DNS and TLS-certificate monitoring for typosquatted domains, newly issued certificates, and default reverse-proxy-kit path/organization signatures
- Run recurring AiTM-specific phishing simulations and user-awareness training reflecting AI-generated, pixel-perfect lure quality
Weaknesses (CWE) in AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM
Timeline of AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM
- Evilginx released as an open-source reverse-proxy AiTM phishing framework (later rewritten in Go), becoming the technical basis for the modern AiTM phishing-kit ecosystem.
- Microsoft publishes a technical breakdown of Storm-1167's multi-stage AiTM plus BEC campaign against banking and financial-services targets: indirect-proxy phishing pages hosted on Tencent Cloud, a Canva intermediary redirect hop, silent addition of a OneWaySMS MFA method with an Iranian country code, and a 16,000+ email follow-on phishing wave launched from the compromised mailbox.
- ENISA Threat Landscape 2025 reports AI-supported phishing exceeding 80% of observed social-engineering activity and phishing as the primary intrusion vector in 60% of observed cases.
- Microsoft Digital Defense Report 2025 attributes 80% of MFA-bypass compromises to stolen session tokens and finds token theft accounted for 31% of Microsoft 365 breaches, with infostealers exposing an estimated 1.8 billion credentials and billions of session cookies in 2025.
- Verizon publishes the 2026 Data Breach Investigations Report (19th edition); industry coverage ties its social-engineering and credential-abuse findings into the broader AiTM/session-theft trend.
- Developer of the Kratos AiTM session-cookie-theft subscription kit reportedly arrested in Indonesia.
- CybersecurityNews' 'Top 10 Phishing Kits' roundup documents Tycoon2FA, EvilProxy, Sneaky2FA, Kali365, Greatness, Cephas, MassBass, and EvilTokens as the dominant active AiTM / OAuth-device-code phishing-as-a-service kits.
- CybersecurityNews publishes 'AI-Generated Phishing No Longer Needs Malware,' documenting malware-free AiTM session-token-theft campaigns that use AI-crafted lures, multi-stage redirect chains, and in-browser DOM manipulation to bypass MFA (hunt source article for this threat record).
Sources cited for AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM
- AI-Generated Phishing No Longer Needs Malware: It Can Steal Your Session Inside the Browser
- Building Enterprise Resilience Against AiTM Phishing
- Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026)
- State-of-the-art phishing: MFA bypass
- Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
- AITM Phishing Attack: How It Works and How to Stop It
- CodeStorm - A Microsoft 365 AiTM Phishing Kit with Storm-1167 Overlap
- Microsoft Digital Defense Report 2025
- ENISA Threat Landscape 2025
- 2026 Data Breach Investigations Report (DBIR)
Detection coverage for TL-2026-1811
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1811 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.