# Green Proxy: Undocumented Microsoft 365 AiTM Phishing-as-a-Service Platform

> Raiku Solutions documents Green Proxy, a previously undocumented adversary-in-the-middle (AiTM) phishing-as-a-service platform targeting Microsoft 365, operating since at least September 2025 and found during an incident at a Chilean company. It proxies Microsoft sign-in pages in real time and captures authenticated sessions even when non-phishing-resistant MFA is enabled.

- **Published:** 2026-11-04T14:07:39Z
- **Last reviewed:** 2026-11-04T14:07:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5240
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5240.png
- **ID:** TL-2026-5240
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

Green Proxy is a Microsoft 365 AiTM phishing-as-a-service (PhaaS) platform first documented by Raiku Solutions on 2026-11-04 after an incident response engagement at a Chilean organization. Access to the customer panel (served at the root of greenproxysimpleserver[.]cc) requires a license key in the format GPKEY-XXXX-XXXX-XXXX, alongside username/email and password fields and a 'Create Account' option, indicating a subscription-style service model. The panel HTML (SHA-256 50448224e0cb3dbcee198157ad6e01f3c59b36b7fb7e43601aa9f94ed842fb6a) was identical between April and November 2026, and the logo file (SHA-256 d1fc8bf9fbb5a0efaef075466ddb2531e07a7a6405e31d2155538c03af77f688) carries a screenshot timestamp of 2025-07-12.

Delivery in the analyzed campaign is two-stage. In stage one, four compromised legitimate Japanese business mailboxes on shared hosting (observed 2026-10-30 to 2026-11-01) sent a minimal 'Quotation' / 'Request for Quotation' email with no links and no attachments, which evades content-based email filtering. In stage two, a follow-up message from a lookalike domain impersonating a real company, carrying a legitimate DKIM signature so SPF/DKIM/DMARC alignment passes, contained a URL abusing a legitimate organization's /oauth/authorize endpoint with prompt=none and id_token_hint=dummy. The redirect chain runs from the legitimate OAuth endpoint to a compromised small-business site and then to the attacker gate. A useful detection indicator is that the sender changes in the middle of the email conversation.

The gate applies anti-analysis controls: POST /.verify performs a SHA-256 proof-of-work bot check (signals include webdriver, HeadlessChrome and software WebGL renderers swiftshader/llvmpipe) and sets a _vfy cookie valid for 7 days; POST /.detect returns a JSON sandbox verdict (type:sandbox, score, ent_count); POST /.devtools is a developer-tools trap using keyboard shortcuts and window-resize heuristics that hides the page. A custom proof-of-work CAPTCHA is served from greenproxysimpleserver[.]cc:8443/captcha/api (returning cid, nonce, difficulty, timestamp) and /captcha/verify; hCaptcha is wired in but disabled (USE_HCAPTCHA = false). The gate JavaScript is unobfuscated and uses emoji-numbered comments. Victims are then passed through one-time /p/<token> redirect hops to proxy relays (e.g. loginlive. and loginms. subdomains of yizhaojingyun[.]com) that relay the real Microsoft sign-in page in real time, capturing credentials and the resulting session so that non-phishing-resistant MFA is bypassed.

Infrastructure centers on 94.26.106[.]29 (AS215607 dataforest GmbH until May 2026, then AS197170 TechTies from 2026-05-31). The yizhaojingyun[.]com domain was re-registered (aged domain, NiceNIC) on 2026-08-24 to the same IP and over 100 random subdomains (120+ in Certificate Transparency) were deployed within two weeks. The earlier panel iteration eargentyna[.]com has 23 subdomains using country-code patterns (pak., indo., bra., fra.), suggesting multi-regional targeting. The same IP distributed Mirai binaries (MalwareBazaar tag 'wraith') from /bins/ on 2026-05-06 and presented a self-signed certificate for cnc.murrezbots[.]vip; Malpedia therefore links the entry to elf.mirai/win.mirai, but the researchers state a shared operator is unproven and the pattern may reflect IP reassignment between operators. Raiku found no overlap with Sneaky 2FA (no filler text, email_from_url, vrs= or 150-character verify paths) or Mamba 2FA/Tycoon2FA markers; the 'Shield' fork of Sneaky 2FA is the closest match (PoW CAPTCHA via API with cid/nonce/difficulty) but implementation, paths, UI and redirects differ. No threat actor is attributed. BeaconBeagle lookups for the network IOCs could not be completed (HTTP 502 on both attempts), so no C2-framework correlation is recorded.

## MITRE ATT&CK

- T1583.001 Domains
- T1586.002 Email Accounts
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1497 Virtualization/Sandbox Evasion
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1550.004 Web Session Cookie

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Green Proxy AiTM Gate Anti-Analysis Endpoints and IOC Hosts — Exploitation Phase** (`TL-2026-5240-SPL-001`)

Detects the Green Proxy (TL-2026-5240) phishing gate in web proxy telemetry: POSTs to the gate's bot-check and sandbox-detection endpoints (/.verify, /.detect, /.devtools), the custom proof-of-work CAPTCHA on port 8443 (/captcha/api, /captcha/verify), and any traffic to greenproxysimpleserver.cc, yizhaojingyun.com, eargentyna.com or ipfs-us.com. A user reaching the gate has been lured into the AiTM flow that proxies the real Microsoft sign-in page and steals the session, bypassing non-phishing-resistant MFA.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1497, T1566.002, T1557
- **Data sources:** splunk:index=proxy sourcetype=stream:http, CommonSecurityLog (proxy CEF), web proxy logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype="stream:http" earliest=-24h ((http_method=POST AND (uri_path="/.verify" OR uri_path="/.detect" OR uri_path="/.devtools")) OR (dest_port=8443 AND (uri_path="/captcha/api" OR uri_path="/captcha/verify")) OR site IN ("greenproxysimpleserver.cc","*.yizhaojingyun.com","*.eargentyna.com","ipfs-us.com"))
```Green Proxy gate endpoints: /.verify = SHA-256 PoW bot check, /.detect = sandbox verdict, /.devtools = devtools trap```
| eval gate_endpoint=case(uri_path="/.verify","verify_pow_botcheck",uri_path="/.detect","sandbox_verdict",uri_path="/.devtools","devtools_trap",match(uri_path,"^/captcha/(api|verify)$"),"pow_captcha",true(),"ioc_host")
| stats count min(_time) as first_seen max(_time) as last_seen values(gate_endpoint) as gate_endpoints dc(gate_endpoint) as endpoint_variety values(site) as sites values(dest_ip) as dest_ips by src_ip
| eval match_basis=if(match(mvjoin(sites,","),"greenproxysimpleserver|yizhaojingyun|eargentyna|ipfs-us"),"ioc_host_match",if(endpoint_variety>=2,"multi_endpoint_gate","single_gate_endpoint"))
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip count gate_endpoints sites dest_ips match_basis
````

### Microsoft KQL

```kql
let ioc_hosts = dynamic(['greenproxysimpleserver.cc','yizhaojingyun.com','eargentyna.com','ipfs-us.com']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (RequestMethod =~ 'POST' and RequestURL matches regex @'/[.](verify|detect|devtools)([?]|$)')
    or (DestinationPort == 8443 and RequestURL matches regex @'/captcha/(api|verify)')
    or DestinationHostName has_any (ioc_hosts)
| extend GateEndpoint = case(RequestURL contains '/.verify', 'verify_pow_botcheck', RequestURL contains '/.detect', 'sandbox_verdict', RequestURL contains '/.devtools', 'devtools_trap', RequestURL contains '/captcha/', 'pow_captcha', 'ioc_host')
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Endpoints = make_set(GateEndpoint), EndpointVariety = dcount(GateEndpoint), Hosts = make_set(DestinationHostName) by SourceIP
| extend MatchBasis = case(tostring(Hosts) has_any (ioc_hosts), 'ioc_host_match', EndpointVariety >= 2, 'multi_endpoint_gate', 'single_gate_endpoint')
| project FirstSeen, LastSeen, SourceIP, Hits, Endpoints, Hosts, MatchBasis
```

### Sigma

```yaml
title: Green Proxy AiTM Gate Anti-Analysis Endpoints in Proxy Logs
id: 7c1d9a4e-3b52-4e86-9f0a-5d2e8b6a1c37
status: experimental
description: Detects POST requests to the Green Proxy phishing gate bot-check, sandbox-detection and devtools-trap endpoints, the custom proof-of-work CAPTCHA on port 8443, or traffic to known Green Proxy gate infrastructure.
references:
  - https://raiku.cl/research/green-proxy
  - https://otx.alienvault.com/pulse/6aeaaae6c9bee051e29ee2bb
author: Threadlinqs Team
date: 2026-11-04
tags:
  - attack.defense-evasion
  - attack.t1497
  - attack.initial-access
  - attack.t1566.002
  - attack.credential-access
  - attack.t1557
logsource:
  category: proxy
detection:
  selection_gate:
    cs-method: 'POST'
    c-uri|contains:
      - '/.verify'
      - '/.detect'
      - '/.devtools'
  selection_captcha:
    c-uri|contains:
      - ':8443/captcha/api'
      - ':8443/captcha/verify'
  selection_host:
    cs-host|endswith:
      - 'greenproxysimpleserver.cc'
      - '.yizhaojingyun.com'
      - '.eargentyna.com'
      - 'ipfs-us.com'
  condition: selection_gate or selection_captcha or selection_host
falsepositives:
  - Security researchers or sandboxes deliberately visiting the gate
  - Unrelated web applications that happen to expose a /.verify style path
level: high
```

**Known false positives:**

- Security researchers, sandboxes or URL scanners deliberately visiting the gate or panel
- Unrelated web applications exposing a /.verify or /.detect path (single_gate_endpoint matches on non-IOC hosts)

**Tuning notes:** Adjust index/sourcetype and field names (http_method, uri_path, site, dest_port) to your proxy's CIM mapping. Prioritise match_basis=ioc_host_match and multi_endpoint_gate; review single_gate_endpoint hits on unknown hosts as possible new gate domains and add them to the IOC list. Exclude known red-team/scanner source IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Green Proxy OAuth prompt=none id_token_hint Lure Link in Email — Exploitation (locked: unlock with TL Creds)
- Green Proxy Two-Stage RFQ Thread With Mid-Conversation Sender Change — Initial Access (locked: unlock with TL Creds)
- Green Proxy Browser Connections to Relay, Panel and CAPTCHA Infrastructure — Endpoint Pivot (locked: unlock with TL Creds)
- Green Proxy OAuth Lure to Gate Redirect Chain in Proxy Logs — Exploitation (locked: unlock with TL Creds)
- Green Proxy Relay IP Authenticating to Entra ID — Post-Exploitation (locked: unlock with TL Creds)
- Green Proxy Community-Related Sibling Domains and murrezbots C2 Name — Infrastructure (locked: unlock with TL Creds)
- Green Proxy Entra ID Session Replay After MFA Sign-In — Post-Exploitation (locked: unlock with TL Creds)
- Green Proxy Infrastructure Contact via DNS, Proxy and Firewall — C2 and Relay (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `94.26.106[.]29`
- Domain: `greenproxysimpleserver[.]cc`
- File hash: `50448224e0cb3dbcee198157ad6e01f3c59b36b7fb7e43601aa9f94ed842fb6a`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Green Proxy: a first look at an undocumented AiTM phishing-as-a-service platform](https://raiku.cl/research/green-proxy)
- [Malpedia library entry: Green Proxy](https://malpedia.caad.fkie.fraunhofer.de/library/a3ccb457-3f89-4828-9c8a-98ca973ddab8/)
- [Archive.org snapshot of Raiku Green Proxy article](https://web.archive.org/20261104135111/https://raiku.cl/research/green-proxy)
- [Raiku SCGX02-IOCs repository (feeds, STIX 2.1, YARA, IOCS.md)](https://github.com/aacunaa/scgx02-iocs)
- [Zenodo record for Green Proxy IOC dataset (DOI 10.5281/zenodo.23949280)](https://doi.org/10.5281/zenodo.23949280)
- [AlienVault OTX pulse for Green Proxy / RFQ AiTM](https://otx.alienvault.com/pulse/6aeaaae6c9bee051e29ee2bb)
- [ThreatFox IOC 2013809 (cnc.murrezbots.vip)](https://threatfox.abuse.ch/ioc/2013809/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5240