EvilProxy AiTM: Indeed Redirect to M365 Cookie Theft

Identity Protection escalated an executive account at Calderwood Logistics Group: a successful Microsoft 365 sign-in that satisfied MFA but originated from a network that does not belong to the company. The email, web-proxy, DNS, Entra sign-in, and perimeter records for the day are in front of you. Read the brief, then work the timeline from the lure to the stolen session.

One account drives the entire anomaly: it received the lure, its session authenticated from outside the corporate estate, and its mailbox was modified. Working from the identity sign-in records and the mail trail, identify the user principal whose session was taken over.

The lure link did not point straight at a malicious site. It pointed at a trusted third-party platform that quietly forwarded the browser elsewhere, which is why URL reputation let the click through. Identify the host the victim's browser first contacted when the link was clicked.

After the redirect, the browser landed on a page that looked like the Microsoft 365 sign-in but was not hosted by Microsoft. That page is the reverse proxy that relayed the real login. Identify the landing domain the victim authenticated against.

The lookalike sign-in domain resolves to the reverse-proxy infrastructure that sat between the victim and Microsoft, and that same external address is where the authenticated session came from. Identify the external IP behind the adversary-in-the-middle session.

The defining move here is that the attacker positioned infrastructure between the victim and the real service, relaying the entire sign-in so they could capture what flowed through. Map that to its MITRE ATT&CK technique.

MFA was satisfied during the sign-in, yet the attacker kept access afterward without being challenged again. For the report, classify the credential-access technique that explains how the attacker retained the authenticated session. Provide its MITRE ATT&CK identifier.