Green Proxy: Undocumented Microsoft 365 AiTM Phishing-as-a-Service Platform

Key facts

Detection coverage

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5240 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Green Proxy AiTM Gate Anti-Analysis Endpoints and IOC Hosts — Exploitation Phase

Detects the Green Proxy (TL-2026-5240) phishing gate in web proxy telemetry: POSTs to the gate's bot-check and sandbox-detection endpoints (/.verify, /.detect, /.devtools), the custom proof-of-work CAPTCHA on port 8443 (/captcha/api, /captcha/verify), and any traffic to greenproxysimpleserver.cc, yizhaojingyun.com, eargentyna.com or ipfs-us.com. A user reaching the gate has been lured into the AiTM flow that proxies the real Microsoft sign-in page and steals the session, bypassing non-phishing-resistant MFA.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1497, T1566.002, T1557
• Data sources: splunk:index=proxy sourcetype=stream:http, CommonSecurityLog (proxy CEF), web proxy logs
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="stream:http" earliest=-24h ((http_method=POST AND (uri_path="/.verify" OR uri_path="/.detect" OR uri_path="/.devtools")) OR (dest_port=8443 AND (uri_path="/captcha/api" OR uri_path="/captcha/verify")) OR site IN ("greenproxysimpleserver.cc","*.yizhaojingyun.com","*.eargentyna.com","ipfs-us.com"))
```Green Proxy gate endpoints: /.verify = SHA-256 PoW bot check, /.detect = sandbox verdict, /.devtools = devtools trap```
| eval gate_endpoint=case(uri_path="/.verify","verify_pow_botcheck",uri_path="/.detect","sandbox_verdict",uri_path="/.devtools","devtools_trap",match(uri_path,"^/captcha/(api|verify)$"),"pow_captcha",true(),"ioc_host")
| stats count min(_time) as first_seen max(_time) as last_seen values(gate_endpoint) as gate_endpoints dc(gate_endpoint) as endpoint_variety values(site) as sites values(dest_ip) as dest_ips by src_ip
| eval match_basis=if(match(mvjoin(sites,","),"greenproxysimpleserver|yizhaojingyun|eargentyna|ipfs-us"),"ioc_host_match",if(endpoint_variety>=2,"multi_endpoint_gate","single_gate_endpoint"))
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip count gate_endpoints sites dest_ips match_basis

Microsoft KQL

let ioc_hosts = dynamic(['greenproxysimpleserver.cc','yizhaojingyun.com','eargentyna.com','ipfs-us.com']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (RequestMethod =~ 'POST' and RequestURL matches regex @'/[.](verify|detect|devtools)([?]|$)')
    or (DestinationPort == 8443 and RequestURL matches regex @'/captcha/(api|verify)')
    or DestinationHostName has_any (ioc_hosts)
| extend GateEndpoint = case(RequestURL contains '/.verify', 'verify_pow_botcheck', RequestURL contains '/.detect', 'sandbox_verdict', RequestURL contains '/.devtools', 'devtools_trap', RequestURL contains '/captcha/', 'pow_captcha', 'ioc_host')
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Endpoints = make_set(GateEndpoint), EndpointVariety = dcount(GateEndpoint), Hosts = make_set(DestinationHostName) by SourceIP
| extend MatchBasis = case(tostring(Hosts) has_any (ioc_hosts), 'ioc_host_match', EndpointVariety >= 2, 'multi_endpoint_gate', 'single_gate_endpoint')
| project FirstSeen, LastSeen, SourceIP, Hits, Endpoints, Hosts, MatchBasis

Sigma

title: Green Proxy AiTM Gate Anti-Analysis Endpoints in Proxy Logs
id: 7c1d9a4e-3b52-4e86-9f0a-5d2e8b6a1c37
status: experimental
description: Detects POST requests to the Green Proxy phishing gate bot-check, sandbox-detection and devtools-trap endpoints, the custom proof-of-work CAPTCHA on port 8443, or traffic to known Green Proxy gate infrastructure.
references:
  - https://raiku.cl/research/green-proxy
  - https://otx.alienvault.com/pulse/6aeaaae6c9bee051e29ee2bb
author: Threadlinqs Team
date: 2026-11-04
tags:
  - attack.defense-evasion
  - attack.t1497
  - attack.initial-access
  - attack.t1566.002
  - attack.credential-access
  - attack.t1557
logsource:
  category: proxy
detection:
  selection_gate:
    cs-method: 'POST'
    c-uri|contains:
      - '/.verify'
      - '/.detect'
      - '/.devtools'
  selection_captcha:
    c-uri|contains:
      - ':8443/captcha/api'
      - ':8443/captcha/verify'
  selection_host:
    cs-host|endswith:
      - 'greenproxysimpleserver.cc'
      - '.yizhaojingyun.com'
      - '.eargentyna.com'
      - 'ipfs-us.com'
  condition: selection_gate or selection_captcha or selection_host
falsepositives:
  - Security researchers or sandboxes deliberately visiting the gate
  - Unrelated web applications that happen to expose a /.verify style path
level: high

Known false positives:

• Security researchers, sandboxes or URL scanners deliberately visiting the gate or panel
• Unrelated web applications exposing a /.verify or /.detect path (single_gate_endpoint matches on non-IOC hosts)

Tuning notes: Adjust index/sourcetype and field names (http_method, uri_path, site, dest_port) to your proxy's CIM mapping. Prioritise match_basis=ioc_host_match and multi_endpoint_gate; review single_gate_endpoint hits on unknown hosts as possible new gate domains and add them to the IOC list. Exclude known red-team/scanner source IPs.

• 🔒 Green Proxy OAuth prompt=none id_token_hint Lure Link in Email — Exploitation · unlock with TL Creds
• 🔒 Green Proxy Two-Stage RFQ Thread With Mid-Conversation Sender Change — Initial Access · unlock with TL Creds
• 🔒 Green Proxy Browser Connections to Relay, Panel and CAPTCHA Infrastructure — Endpoint Pivot · unlock with TL Creds
• 🔒 Green Proxy OAuth Lure to Gate Redirect Chain in Proxy Logs — Exploitation · unlock with TL Creds
• 🔒 Green Proxy Relay IP Authenticating to Entra ID — Post-Exploitation · unlock with TL Creds
• 🔒 Green Proxy Community-Related Sibling Domains and murrezbots C2 Name — Infrastructure · unlock with TL Creds
• 🔒 Green Proxy Entra ID Session Replay After MFA Sign-In — Post-Exploitation · unlock with TL Creds
• 🔒 Green Proxy Infrastructure Contact via DNS, Proxy and Firewall — C2 and Relay · unlock with TL Creds

Indicators of compromise

As of 2026-11-04, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5240.

Sample indicators (3 of 17)

• IP address: 94.26.106[.]29
• Domain: greenproxysimpleserver[.]cc
• File hash: 50448224e0cb3dbcee198157ad6e01f3c59b36b7fb7e43601aa9f94ed842fb6a

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Green Proxy is a Microsoft 365 AiTM phishing-as-a-service (PhaaS) platform first documented by Raiku Solutions on 2026-11-04 after an incident response engagement at a Chilean organization. Access to the customer panel (served at the root of greenproxysimpleserver[.]cc) requires a license key in the format GPKEY-XXXX-XXXX-XXXX, alongside username/email and password fields and a 'Create Account' option, indicating a subscription-style service model. The panel HTML (SHA-256 50448224e0cb3dbcee198157ad6e01f3c59b36b7fb7e43601aa9f94ed842fb6a) was identical between April and November 2026, and the logo file (SHA-256 d1fc8bf9fbb5a0efaef075466ddb2531e07a7a6405e31d2155538c03af77f688) carries a screenshot timestamp of 2025-07-12.

Delivery in the analyzed campaign is two-stage. In stage one, four compromised legitimate Japanese business mailboxes on shared hosting (observed 2026-10-30 to 2026-11-01) sent a minimal 'Quotation' / 'Request for Quotation' email with no links and no attachments, which evades content-based email filtering. In stage two, a follow-up message from a lookalike domain impersonating a real company, carrying a legitimate DKIM signature so SPF/DKIM/DMARC alignment passes, contained a URL abusing a legitimate organization's /oauth/authorize endpoint with prompt=none and id_token_hint=dummy. The redirect chain runs from the legitimate OAuth endpoint to a compromised small-business site and then to the attacker gate. A useful detection indicator is that the sender changes in the middle of the email conversation.

The gate applies anti-analysis controls: POST /.verify performs a SHA-256 proof-of-work bot check (signals include webdriver, HeadlessChrome and software WebGL renderers swiftshader/llvmpipe) and sets a _vfy cookie valid for 7 days; POST /.detect returns a JSON sandbox verdict (type:sandbox, score, ent_count); POST /.devtools is a developer-tools trap using keyboard shortcuts and window-resize heuristics that hides the page. A custom proof-of-work CAPTCHA is served from greenproxysimpleserver[.]cc:8443/captcha/api (returning cid, nonce, difficulty, timestamp) and /captcha/verify; hCaptcha is wired in but disabled (USE_HCAPTCHA = false). The gate JavaScript is unobfuscated and uses emoji-numbered comments. Victims are then passed through one-time /p/<token> redirect hops to proxy relays (e.g. loginlive. and loginms. subdomains of yizhaojingyun[.]com) that relay the real Microsoft sign-in page in real time, capturing credentials and the resulting session so that non-phishing-resistant MFA is bypassed.

Infrastructure centers on 94.26.106[.]29 (AS215607 dataforest GmbH until May 2026, then AS197170 TechTies from 2026-05-31). The yizhaojingyun[.]com domain was re-registered (aged domain, NiceNIC) on 2026-08-24 to the same IP and over 100 random subdomains (120+ in Certificate Transparency) were deployed within two weeks. The earlier panel iteration eargentyna[.]com has 23 subdomains using country-code patterns (pak., indo., bra., fra.), suggesting multi-regional targeting. The same IP distributed Mirai binaries (MalwareBazaar tag 'wraith') from /bins/ on 2026-05-06 and presented a self-signed certificate for cnc.murrezbots[.]vip; Malpedia therefore links the entry to elf.mirai/win.mirai, but the researchers state a shared operator is unproven and the pattern may reflect IP reassignment between operators. Raiku found no overlap with Sneaky 2FA (no filler text, email_from_url, vrs= or 150-character verify paths) or Mamba 2FA/Tycoon2FA markers; the 'Shield' fork of Sneaky 2FA is the closest match (PoW CAPTCHA via API with cid/nonce/difficulty) but implementation, paths, UI and redirects differ. No threat actor is attributed. BeaconBeagle lookups for the network IOCs could not be completed (HTTP 502 on both attempts), so no C2-framework correlation is recorded.

MITRE ATT&CK techniques by tactic:

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Defense Evasion

T1497 Virtualization/Sandbox Evasion; T1684.001 Impersonation

Lateral Movement

T1550.004 Web Session Cookie

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1586.002 Email Accounts

Remediation

Immediate actions

• Block greenproxysimpleserver[.]cc, yizhaojingyun[.]com, eargentyna[.]com, ipfs-us[.]com, murrezbots[.]vip and IPs 94.26.106.29, 91.92.47.181, 45.153.34.192 at DNS, proxy and perimeter (use the real, non-defanged values in controls)
• Hunt proxy/web logs for POST requests to /.verify, /.detect and /.devtools and for requests to :8443/captcha/api and :8443/captcha/verify
• Search mail logs for /oauth/authorize links containing prompt=none or id_token_hint= whose redirect_uri diverges from the sender domain
• Flag 'Re:' threads where the sender changes mid-conversation and a link from a previously unseen lookalike domain appears
• Audit Entra ID / Azure sign-in logs for suspicious relay patterns and revoke sessions and tokens of users who interacted with the lures
• Review mailbox logs for the compromised Japanese business accounts that sent the first-stage RFQ emails and notify the owners

Workarounds

• Search urlscan.io for the panel HTML and logo SHA-256 hashes to find additional Green Proxy panels
• Apply the Raiku-published YARA rules (yara/rfq-aitm.yar) and STIX 2.1 bundle to web/email telemetry

Longer-term hardening

• Deploy phishing-resistant MFA (FIDO2 / passkeys) to defeat session-relay AiTM attacks
• Enforce DMARC and monitor OAuth flows for suspicious prompt=none parameters
• Implement browser isolation for high-risk users
• Enable conditional access policies, including blocking sign-ins from non-compliant devices

Affected and fixed versions

• Microsoft — Microsoft 365 / Entra ID sign-in (accounts not protected by phishing-resistant MFA)
  Vulnerable versions: Accounts using non-phishing-resistant MFA
  Fixed in: Accounts enforcing FIDO2 / passkey phishing-resistant authentication

Timeline

• 2025-07-12 Screenshot timestamp embedded in the Green Proxy panel logo file (SHA-256 d1fc8bf9...) dates to 2025-07-12.
• 2025-09-01 Green Proxy reported operational since at least September 2025 (month precision); locked-ioc-6 registered and locked-ioc-11 subdomains issued in the Sep-Nov 2025 window.
• 2026-04-01 Customer panel at locked-ioc-6 first visible on urlscan.io (April 2026, month precision); panel HTML hash stays identical through November 2026.
• 2026-05-06 IP locked-ioc-13 distributed Mirai binaries from /bins/ (MalwareBazaar tag 'wraith') and presented a self-signed certificate for locked-ioc-9.
• 2026-05-31 IP block containing locked-ioc-13 announced by TechTies (AS197170), replacing dataforest GmbH (AS215607); possible reassignment between operators.
• 2026-08-24 Aged domain locked-ioc-10 re-registered (NiceNIC) pointing to locked-ioc-13; 100+ random proxy subdomains deployed within two weeks.
• 2026-10-30 Stage-one 'Request for Quotation' emails sent from four compromised Japanese business mailboxes (activity observed 2026-10-30 to 2026-11-01), followed by lookalike-domain OAuth-redirect lures; campaign detected at a Chilean company.
• 2026-11-04 Raiku Solutions publishes 'Green Proxy' research with IOCs, YARA rules and STIX bundle; Malpedia entry created.

Sources cited

• AlienVault OTX pulse for Green Proxy / RFQ AiTM otx.alienvault.com · Advisory · 2026-11-04
• ThreatFox IOC 2013809 (cnc.murrezbots.vip) threatfox.abuse.ch · Advisory · 2026-11-04
• Green Proxy: a first look at an undocumented AiTM phishing-as-a-service platform raiku.cl · Research · 2026-11-04
• Malpedia library entry: Green Proxy malpedia.caad.fkie.fraunhofer.de · Research · 2026-11-04
• Zenodo record for Green Proxy IOC dataset (DOI 10.5281/zenodo.23949280) doi.org · Research · 2026-11-04
• Raiku SCGX02-IOCs repository (feeds, STIX 2.1, YARA, IOCS.md) GitHub · Code repository · 2026-11-04
• Archive.org snapshot of Raiku Green Proxy article web.archive.org · Blog · 2026-11-04

More in phishing

• Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)
• 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites
• Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)
• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting

Previous and next in phishing

• October 2026 Campaigns: Device-Code Phishing Kits (SkyW4lker, GeorgeGinx, Mir0Auth), Fake AI Lures, and WKLP Python Infostealer/RAT Previous report
• Operation CloudFire: Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA via Live Reverse Proxy (Nyasher) Next report