A newly identified phishing-as-a-service kit is being used to hijack Microsoft 365 accounts by stealing victims’ active login sessions rather than their passwords, according to new research from cybersecurity firm Huntress, a technique that allows attackers to walk straight past multi-factor authentication (MFA) without ever needing to guess, crack, or bypass it.
The kit, dubbed “Knight Office” by researchers, came to light after Huntress’s Security Operations Centre investigated suspicious sign-in activity on a customer’s Microsoft 365 account in August. While tracing the source of the intrusion, analysts found the attacker’s own operator console, a slickly built dashboard, complete with a Cloudflare Turnstile bot-check and real-time visitor statistics, used to manage victims and harvested logins from a single screen.
Huntress was careful to distinguish this operator-facing panel, which gives the attacker a live view of victims and their stolen data, from the underlying phishing kit code itself, which handles the victim-facing side of the attack, such as the fake login pages used to trick targets.
How the attack works
According to Huntress, the campaign begins with a fake email styled to look like a DocuSign signature request, complete with an urgent subject line pressuring the recipient to act. In a twist designed to dodge suspicion, the emails are “self-spoofed” and forged so that they appear to come from the recipient’s own email address.
Clicking the link in the email sends victims through a chain of redirects, including via the legitimate Monday.com work-management platform and a compromised Joomla website, designed to obscure the final destination from email security scanners. Victims land on a convincing fake Microsoft page that presents them with what looks like a normal “device login” code, mimicking the legitimate process Microsoft uses to sign into apps on other devices.
Once a victim enters the code and completes the Microsoft login, including approving the MFA prompt on their phone, exactly as they would for a genuine sign-in — the attacker’s infrastructure silently intercepts and captures their live session. That stolen session is instantly usable, letting the attacker access the account as though they were the legitimate user, with no password and no MFA prompt of their own required.
Huntress said its telemetry showed the stolen tokens being reused from data-centre hosting infrastructure, and that because no password was ever entered incorrectly, standard password-based detection alerts never fired.
Attackers dug in for the long haul
Huntress’s investigation found that the attacker didn’t stop at the initial break-in. After gaining access, they registered a rogue, attacker-controlled device against the victim’s Microsoft Entra ID (formerly Azure AD) tenant and bound a Windows Hello for Business (WHfB) passwordless credential to the compromised account, effectively planting a backdoor that would let them log back in even after the original stolen session was revoked.
The technique, researchers noted, turns a feature designed to make sign-in more secure for legitimate users into a persistence mechanism for attackers.
Scale of the campaign
Huntress said the same operator console has been linked to at least nine confirmed phishing attacks on Microsoft 365 and Google Workspace accounts within its own customer base over a two-week period. Separately, the firm said more than 700 emails matching the same lure and template have been reported by users through its security awareness training platform since April, suggesting the campaign has been running for months at considerably larger scale.
Variants of the lure’s subject line spotted by researchers include messages disguised as voicemail notifications and shared-document alerts, several of which substitute the lowercase letter “l” for “i” in words such as “Important” and “Signature” — likely an attempt to dodge spam filters that scan for exact keyword matches.
Part of a wider shift away from passwords
Knight Office is the latest in a string of phishing kits Huntress has tracked that focus on stealing session tokens or OAuth access tokens rather than credentials, following similar findings around kits called EvilTokens and Kali365. Security researchers have warned that this style of attack, known as adversary-in-the-middle (AiTM) phishing, is becoming increasingly popular precisely because it renders traditional password hygiene and even MFA far less effective as standalone defences.
Huntress recommended that organisations look beyond failed login attempts and password-spray alerts when hunting for this kind of activity, and instead watch for unexpected post-MFA authentication events from unfamiliar devices or callback proxies, review newly registered Entra ID devices and WHfB credentials, and promptly revoke unauthorised authentication methods when found.
Indicators of Compromise
Huntress has published a full list of indicators of compromise associated with the campaign, including the IP address of the phishing control panel (104.37.188[.]94), the domain hosting it (idoej[.]com), and more than two dozen lookalike phishing domains using the .vu top-level domain.
