Known malicious kitcriticalphishing
AiTM reverse proxy — Microsoft endpoints rewritten into the attacker's path
family: aitm-proxy-url-rewrite
Short link:scanmalware.com/h/176
Toolkit-agnostic detection for the structural artefact every Evilginx-style AiTM proxy leaves behind. A real AiTM relay does not clone the Microsoft sign-in page — it forwards the genuine flow and rewrites the URLs in the response, so Microsoft's own endpoints end up embedded in the PATH of the attacker's origin: https://<attacker>/https://login.microsoftonline.com/common/GetCredentialType, .../common/login, .../common/SAS/BeginAuth, .../common/SAS/EndAuth. Because the page is the real Microsoft page, brand-similarity, favicon, screenshot-hash and OCR checks all agree it looks legitimate — which is exactly why the rewriting artefact, rather than the page's appearance, is the thing to key on.
Anchors
YARA ruleDetect_AiTM_Proxy_Microsoft_URL_Rewrite
Provenance
Added: 2026-08-10 20:57
YARA-only: the signal lives in the page HTML. Kept in its own family rather than under rcfh-aitm-storm2755 because the rule is not toolkit-specific: a sighting means 'something is proxying Entra ID', not 'Storm-2755'. False-positive posture: the Microsoft-specific rewrite did not appear in any spelling tested (plain, percent-encoded, collapsed-slash) across a large sample of recorded page requests, and 'SAS/BeginAuth' did not appear at all. The generic technique is NOT clean: '/https://' inside a path is common in image optimisers and reader proxies, which is why the rule names login.microsoftonline.com rather than matching path-embedded URLs in general, and also excludes web.archive.org, r.jina.ai, translate.goog, corsproxy.io, allorigins, 12ft.io, /cdn-cgi/image/, /_next/image and wsrv.nl. Reach caveat: the toolkit checks webdriver, WebGL and hardwareConcurrency before serving the relayed page, so an automated capture may only reach the fingerprinting stage. The fingerprint-path rule in the rcfh-aitm-storm2755 family covers that case.
Sightings (0)Atom feed
No sightings recorded yet.