EvilProxy AiTM Phishing Campaign: Global Procurement Lures & Session Hijacking — OTX Pulse Analysis

Recent intelligence from OTX exposes an active Adversary-in-the-Middle (AiTM) phishing campaign active since May 2026. This operation, attributed to the threat actor cluster "FlowerStorm," specifically targets the Education, Government, and Finance sectors. The adversary leverages compromised organizational email accounts to distribute procurement-themed lures, mimicking requests for information (RFI), bid invitations, and project documentation to establish trust.

The attack chain utilizes the EvilProxy Phishing-as-a-Service (PhaaS) platform. The primary objective is to bypass Multi-Factor Authentication (MFA) by intercepting authentication sessions between the victim and legitimate service providers. By stealing session cookies rather than just static credentials, the actor maintains persistent access to enterprise email and cloud environments without triggering standard MFA prompts, facilitating follow-on activities like business email compromise (BEC).

Threat Actor / Malware Profile

• Adversary/Tool: FlowerStorm / EvilProxy (PhaaS)
• Distribution Method: Spear-phishing via compromised internal email accounts. The use of legitimate, hijacked accounts allows the adversary to bypass standard email security filters (SPF/DKIM) and lowers victim suspicion.
• Payload/Behavior: AiTM reverse proxy. The victim is routed through a reverse proxy server (hosted on the IOCs) which sits between the user and the legitimate login page (e.g., Microsoft 365). The proxy captures credentials and the session cookie (authentication token) in real-time, relaying them to the legitimate service to complete the login while stealing the session.
• C2 Communication: The listed IOC domains serve as the front-end infrastructure for the reverse proxy. They forward traffic to the legitimate site while exfiltrating tokens to the actor's backend infrastructure.
• Persistence: No file-based malware persistence is established on the host. Persistence is achieved purely through the use of valid session cookies (Pass-the-Cookie) on the web application layer, allowing the actor to re-authenticate without credentials.
• Anti-Analysis: Uses domains that often mimic legitimate corporate entities or generic-sounding services to blend in with background traffic and evade basic reputation filters.

IOC Analysis

The provided indicators consist of domain names associated with the EvilProxy infrastructure. These domains act as the landing pages for the phishing kits and the entry point for the reverse proxy.

• Operationalization: SOC teams should immediately block these domains at the DNS resolver, firewall, and Secure Web Gateway (SWG) levels. Due to the AiTM nature, these domains may appear to have valid TLS certificates issued by legitimate CAs (e.g., Let's Encrypt), relying on domain reputation rather than certificate anomalies for detection.
• Tooling: SIEMs can correlate these domains against proxy logs (DeviceNetworkEvents) and DNS logs (DnsEvents). Threat Intelligence Platforms (TIPs) should be updated to auto-block these indicators.

Detection Engineering

Sigma Rules

title: Potential EvilProxy AiTM Phishing Domain Connection
id: 4c1f2b3d-5e6a-4f7c-8b9a-1d2e3f4g5h6i
status: experimental
description: Detects network connections to known EvilProxy infrastructure domains identified in OTX pulses related to FlowerStorm procurement phishing.
author: Security Arsenal
date: 2026/07/22
references:
    - https://otx.alienvault.com/
tags:
    - attack.credential_access
    - attack.t1557.001 # Adversary-in-the-Middle
logsource:
    category: network_connection
detection:
    selection:
        dst|contains:
            - 'sohantraders.com'
            - 'satoriestate.com'
            - 'company.com'
            - 'duemineral.uk'
            - 'assessmentevaluationreport.com'
            - 'barifurniture.net'
            - 'consistenthostinghub.de'
            - 'corporatetermscompliance.com'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: DNS Query to Suspicious Procurement Phishing Domains
id: 5d2e3c4f-6f7b-5g8d-9c0b-2e3f4g5h6i7j
status: experimental
description: Identifies DNS queries for domains associated with the Global Procurement-themed AiTM campaign.
author: Security Arsenal
date: 2026/07/22
logsource:
    product: windows
    service: dns
detection:
    selection:
        query|contains:
            - 'sohantraders.com'
            - 'satoriestate.com'
            - 'company.com'
            - 'duemineral.uk'
            - 'assessmentevaluationreport.com'
            - 'barifurniture.net'
            - 'consistenthostinghub.de'
            - 'corporatetermscompliance.com'
    condition: selection
falsepositives:
    - Legitimate administrative access (unlikely for these specific domains)
level: high
---
title: Suspicious User-Agent Associated with EvilProxy Activity
id: 6e3f4d5g-7g8c-6h9e-0d1c-3f4g5h6i7j8k
status: experimental
description: Detects potential interaction with EvilProxy panels based on known user-agent patterns often used in these campaigns.
author: Security Arsenal
date: 2026/07/22
logsource:
    category: proxy
detection:
    selection:
        c-useragent|contains:
            - 'EvilProxy'
            - 'Python-urllib' # Commonly used by kits for backend checks, though noisy
    condition: selection
falsepositives:
    - Legitimate python scripting
level: medium


KQL (Microsoft Sentinel)
kql
// Hunt for connections to known AiTM procurement phishing domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "sohantraders.com", 
    "satoriestate.com", 
    "company.com", 
    "duemineral.uk", 
    "assessmentevaluationreport.com", 
    "barifurniture.net", 
    "consistenthostinghub.de", 
    "corporatetermscompliance.com"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType


PowerShell
powershell
# IOC Hunt: Check DNS Cache for AiTM Phishing Domains
$TargetDomains = @(
    "sohantraders.com",
    "satoriestate.com",
    "company.com",
    "duemineral.uk",
    "assessmentevaluationreport.com",
    "barifurniture.net",
    "consistenthostinghub.de",
    "corporatetermscompliance.com"
)

Write-Host "Checking local DNS cache for procurement-themed AiTM indicators..."

$DnsCache = Get-DnsClientCache

foreach ($Domain in $TargetDomains) {
    $Hits = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Hits) {
        Write-Host "[ALERT] Found cache entry for: $Domain" -ForegroundColor Red
        $Hits | Format-List Entry, Data, Type
    }
}

Write-Host "Hunt complete."

Response Priorities

• Immediate:
  • Block all listed domains at the DNS, Proxy, and Firewall levels.
  • Execute the PowerShell script across endpoints to check for recent DNS cache hits indicating potential infection.
• 24h:
  • Review Azure AD / Entra ID sign-in logs for "Impossible Travel" events or sign-ins from anomalous IP addresses for users who may have interacted with procurement emails recently.
  • Revoke active sessions for high-privileged accounts in the targeted departments (Finance/Procurement).
• 1 week:
  • Conduct targeted security awareness training for procurement and finance teams regarding "Bid Invitation" scams.
  • Accelerate the rollout of FIDO2/WebAuthn (phishing-resistant MFA) to mitigate AiTM risks, as AiTM cannot intercept the cryptographic handshake of FIDO2.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub