How the Attack Works (Technical Mechanism)

The attacker sets up an intermediate phishing site that acts as a live reverse proxy between the victim and legitimate Microsoft 365 authentication services . When a victim enters credentials and completes MFA, the proxy captures the resulting session cookie before it reaches the victim's browser. The attacker then imports that cookie into their own browser and gains full access to the victim's Exchange Online, SharePoint, OneDrive, and any federated apps .

Multiple sources describe the same core mechanism: the proxy creates real-time bidirectional communication, whereas traditional phishing merely clones login pages and harvests credentials . Because the session token proves the user already passed MFA, the attacker never needs to crack the MFA itself .

Why Standard MFA Is Not Enough

Microsoft's own documentation warns that AiTM phishing defeats common MFA methods like SMS codes, authenticator app push notifications, and TOTP tokens . The session cookie issued after MFA completes is the prize: if stolen, it can be replayed from any device, anywhere, until the token expires or is administratively revoked.

Infoblox's report emphasizes that traditional MFA is insufficient because AiTM proxies steal the session token issued after MFA completes . The underlying problem is architectural: the proxy sits between the user and the real authentication endpoint in a way that classic MFA cannot detect.

Defenses Beyond MFA Recommended by Infoblox

Infoblox recommends a layered defense strategy that does not rely on MFA as a single point of failure. Their primary recommendations include:

1. DNS-layer security – Block known malicious domains and newly registered algorithmic domains (RDGAs) at the DNS level to disrupt phishing infrastructure before users can reach it .
2. Phishing-resistant credentials – Deploy FIDO2/WebAuthn hardware security keys or Windows Hello for Business. These use public-key cryptography bound to a specific origin. An AiTM proxy cannot forward FIDO2 challenges because the cryptographic assertion is tied to the legitimate site's domain, not to the proxy.
3. Conditional Access policies – Enforce strict sign-in risk policies in Microsoft Entra ID, such as requiring token binding, blocking sign-ins from unusual locations or devices, and shortening session lifetimes to reduce the window of cookie replay.
4. Exposure management and brand monitoring – Proactively detect phishing domains that impersonate the organization and takedown infrastructure before users encounter the lures .
5. Security awareness and reporting – Train users to recognize procurement-themed phishing lures and to report suspicious emails, enabling faster SOC response.

The FBI has also warned specifically about Kali365, advising organizations to audit their MFA methods, review sign-in logs for anomalous device code flows, and consider blocking device code authentication for all users except trusted applications .

Evidence Limitations and Scope

The Infoblox report is the primary source for the campaign's name, targeting of EU/UN institutions, and use of compromised Outlook mailboxes and small-business sites. Secondary reporting independently confirms the targets and kit rotation.

The Kali365 component is independently confirmed by the FBI's PSA and by security vendors Huntress and Paubox , but Infoblox's report groups it alongside EvilProxy and FlowerStorm under the same procurement-themed infrastructure.

The defensive recommendations combine direct statements from Infoblox's report with well-established industry best practices documented across multiple sources . No single paragraph in the sources enumerates every defensive item in bullet-point form; the list above synthesizes the guidance found across the cited material.

The Bottom Line

"The Procurement Trap" illustrates a growing trend: threat actors are not trying to crack MFA—they are sidestepping it entirely by stealing the session cookies issued after successful authentication. Technical countermeasures like FIDO2 hardware keys and DNS-level domain blocking can significantly reduce exposure, but the first line of defense remains user vigilance. Organizations using Microsoft 365 should review their authentication logs for unexpected device code or AiTM patterns and implement phishing-resistant credentials as a priority.

How the Attack Works (Technical Mechanism)

The attacker sets up an intermediate phishing site that acts as a live reverse proxy between the victim and legitimate Microsoft 365 authentication services . When a victim enters credentials and completes MFA, the proxy captures the resulting session cookie before it reaches the victim's browser. The attacker then imports that cookie into their own browser and gains full access to the victim's Exchange Online, SharePoint, OneDrive, and any federated apps .

Multiple sources describe the same core mechanism: the proxy creates real-time bidirectional communication, whereas traditional phishing merely clones login pages and harvests credentials . Because the session token proves the user already passed MFA, the attacker never needs to crack the MFA itself .

Why Standard MFA Is Not Enough

Microsoft's own documentation warns that AiTM phishing defeats common MFA methods like SMS codes, authenticator app push notifications, and TOTP tokens . The session cookie issued after MFA completes is the prize: if stolen, it can be replayed from any device, anywhere, until the token expires or is administratively revoked.

Infoblox's report emphasizes that traditional MFA is insufficient because AiTM proxies steal the session token issued after MFA completes . The underlying problem is architectural: the proxy sits between the user and the real authentication endpoint in a way that classic MFA cannot detect.

Defenses Beyond MFA Recommended by Infoblox

Infoblox recommends a layered defense strategy that does not rely on MFA as a single point of failure. Their primary recommendations include:

1. DNS-layer security – Block known malicious domains and newly registered algorithmic domains (RDGAs) at the DNS level to disrupt phishing infrastructure before users can reach it .
2. Phishing-resistant credentials – Deploy FIDO2/WebAuthn hardware security keys or Windows Hello for Business. These use public-key cryptography bound to a specific origin. An AiTM proxy cannot forward FIDO2 challenges because the cryptographic assertion is tied to the legitimate site's domain, not to the proxy.
3. Conditional Access policies – Enforce strict sign-in risk policies in Microsoft Entra ID, such as requiring token binding, blocking sign-ins from unusual locations or devices, and shortening session lifetimes to reduce the window of cookie replay.
4. Exposure management and brand monitoring – Proactively detect phishing domains that impersonate the organization and takedown infrastructure before users encounter the lures .
5. Security awareness and reporting – Train users to recognize procurement-themed phishing lures and to report suspicious emails, enabling faster SOC response.

The FBI has also warned specifically about Kali365, advising organizations to audit their MFA methods, review sign-in logs for anomalous device code flows, and consider blocking device code authentication for all users except trusted applications .

Evidence Limitations and Scope

The Infoblox report is the primary source for the campaign's name, targeting of EU/UN institutions, and use of compromised Outlook mailboxes and small-business sites. Secondary reporting independently confirms the targets and kit rotation.

The Kali365 component is independently confirmed by the FBI's PSA and by security vendors Huntress and Paubox , but Infoblox's report groups it alongside EvilProxy and FlowerStorm under the same procurement-themed infrastructure.

The defensive recommendations combine direct statements from Infoblox's report with well-established industry best practices documented across multiple sources . No single paragraph in the sources enumerates every defensive item in bullet-point form; the list above synthesizes the guidance found across the cited material.

The Bottom Line

"The Procurement Trap" illustrates a growing trend: threat actors are not trying to crack MFA—they are sidestepping it entirely by stealing the session cookies issued after successful authentication. Technical countermeasures like FIDO2 hardware keys and DNS-level domain blocking can significantly reduce exposure, but the first line of defense remains user vigilance. Organizations using Microsoft 365 should review their authentication logs for unexpected device code or AiTM patterns and implement phishing-resistant credentials as a priority.