# AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM Session Theft

> Phishing campaigns are moving away from malware delivery toward adversary-in-the-middle (AiTM) techniques that operate entirely inside the victim's browser, using AI-crafted lures, multi-stage redirect chains, and DOM manipulation to render credential-harvesting interfaces indistinguishable from legitimate enterprise sign-in pages while stealing session tokens to bypass MFA.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-07-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1811
- **ID:** TL-2026-1811
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Security researchers are documenting a decisive shift in phishing tradecraft: attackers are abandoning malware-based credential theft in favor of adversary-in-the-middle (AiTM) techniques that operate entirely inside the victim's browser, using AI-generated lures and dynamically rendered DOM content to make the interception layer indistinguishable from the legitimate service being spoofed.

The modern kill chain begins with a trusted-looking email or message -- increasingly authored or refined with generative AI, per ENISA's finding that AI-supported content represented over 80% of observed social-engineering activity in early 2025 -- that routes the victim through a multi-stage redirect chain, often bouncing through a legitimate SaaS platform before landing on the AiTM proxy. In Microsoft's documented Storm-1167 campaign, victims were routed through a legitimate Canva page before arriving at a Tencent-Cloud-hosted fake Microsoft sign-in page. Reverse-proxy toolkits such as Evilginx2, EvilProxy, Modlishka, and Muraena, and their commercialized Phishing-as-a-Service (PhaaS) descendants -- Tycoon 2FA (operated by Storm-1747, ~76% of PhaaS traffic), Sneaky2FA, Rockstar 2FA, Mamba 2FA, Greatness, Kratos, Kali365, and EvilTokens -- sit between the victim and the real identity provider (Microsoft 365/Entra ID, Google Workspace, Okta), relaying the login form in real time so the victim's password AND completed MFA challenge both transit the attacker's infrastructure. The proxy captures the resulting session cookie/token rather than the password alone, which is why the technique defeats password- and TOTP-based MFA without cryptographically breaking it -- it simply steals the already-authenticated session.

The DOM-manipulation layer that gives this trend its 'malware-free' character includes dynamically injected scripts, hidden form fields, fake CAPTCHA gates used to filter out security scanners and sandboxes, and anti-bot IP/User-Agent filtering, all executed client-side inside an encrypted HTTPS session -- which is why traditional network and endpoint tooling (no dropped executable, no anomalous process) misses it. Analysts (ANY.RUN, Cisco Talos) recommend recovering this visibility via in-browser SSL/TLS session-key extraction from process memory rather than certificate-replacing MITM interception.

Once a session cookie is captured, documented post-compromise behavior from Microsoft's Storm-1167 disclosure includes replaying the cookie from a new IP to sign in without a fresh MFA prompt, silently adding a secondary MFA method (a OneWaySMS number, observed with an Iranian country code) to preserve access after the original token expires, creating inbox rules to archive and mark security notifications as read, and using the compromised mailbox to launch large-scale follow-on phishing (16,000+ emails in the observed case) against the victim's own contacts -- converting a single AiTM compromise into a self-propagating BEC campaign.

Industry telemetry frames the scale of the shift: Microsoft's Digital Defense Report 2025 attributes 80% of MFA-bypass compromises to stolen session tokens and found token theft accounted for 31% of Microsoft 365 breaches; infostealers alone exposed an estimated 1.8 billion credentials and billions of session cookies in 2025, frequently targeting the Entra ID ESTSAUTHPERSISTENT persistent-session cookie specifically. AiTM incident volume is reported up 146% year-over-year with close to 40,000 daily incidents detected. FBI IC3 attributes $3.05 billion in annual losses to Business Email Compromise, the downstream monetization path for many AiTM compromises.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1586 Compromise Accounts
- T1566 Phishing
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1204 User Execution
- T1556 Modify Authentication Process
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1684.001 Impersonation
- T1078 Valid Accounts
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1534 Internal Spearphishing
- T1114 Email Collection
- T1557 Adversary-in-the-Middle
- T1090 Proxy
- T1102 Web Service
- T1071 Application Layer Protocol

## Sources

- [AI-Generated Phishing No Longer Needs Malware: It Can Steal Your Session Inside the Browser](https://cybersecuritynews.com/ai-generated-phishing-without-malware/)
- [Building Enterprise Resilience Against AiTM Phishing](https://any.run/cybersecurity-blog/enterprise-phishing-resilience/)
- [Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026)](https://cybersecuritynews.com/top-10-phishing-kits-used-by-hackers/)
- [State-of-the-art phishing: MFA bypass](https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypass/)
- [Detecting and mitigating a multi-stage AiTM phishing and BEC campaign](https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/)
- [AITM Phishing Attack: How It Works and How to Stop It](https://www.group-ib.com/resources/knowledge-hub/aitm-attack/)
- [CodeStorm - A Microsoft 365 AiTM Phishing Kit with Storm-1167 Overlap](https://hexastrike.com/resources/blog/threat-intelligence/codestorm-a-microsoft-365-aitm-phishing-kit-with-storm-1167-overlap/)
- [Microsoft Digital Defense Report 2025](https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/)
- [ENISA Threat Landscape 2025](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025)
- [2026 Data Breach Investigations Report (DBIR)](https://www.verizon.com/business/resources/reports/dbir/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1811