Cybersecurity articles tagged #AitM on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/dismantling-kratos-law-enforcement-disrupts-phishing-as-a-service-hubhttps://runtimerebel.com/blog/dismantling-kratos-law-enforcement-disrupts-phishing-as-a-service-hubLaw enforcement agencies dismantle the Kratos PhaaS platform, arresting its developer and disrupting infrastructure used for high-scale session cookie theft.Wed, 22 Jul 2026 02:46:13 GMTKratos PhaaSAitMPhishing as a ServiceCybercrime TakedownCredential Thefthttps://runtimerebel.com/blog/forg365-phaas-bypassing-mfa-in-microsoft-365-via-aitm-attackshttps://runtimerebel.com/blog/forg365-phaas-bypassing-mfa-in-microsoft-365-via-aitm-attacksForg365 PhaaS enables attackers to compromise Microsoft 365 accounts using AI-assisted lures and device code phishing to bypass multi-factor authentication.Mon, 13 Jul 2026 14:38:14 GMTForg365Microsoft 365PhaaSAitMDevice Code Phishinghttps://runtimerebel.com/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kitshttps://runtimerebel.com/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kitsA misconfigured Python server exposed three live Evilginx phishing operations targeting Microsoft 365, revealing the attacker's toolkit and session cookies.Mon, 13 Jul 2026 11:18:10 GMTEvilginxMicrosoft 365PhishingAitMMFA Bypasshttps://runtimerebel.com/blog/forg365-phaas-leverages-ai-aitm-for-microsoft-365-account-compromisehttps://runtimerebel.com/blog/forg365-phaas-leverages-ai-aitm-for-microsoft-365-account-compromiseForg365 PhaaS targets Microsoft 365 with AI-assisted AiTM and device code phishing.Thu, 09 Jul 2026 15:14:50 GMTForg365Phishing as a ServicePhaaSMicrosoft 365AitMAI PhishingDevice Code Phishinghttps://runtimerebel.com/blog/blackfile-analyzing-unc6671-vishing-cloud-data-extortionhttps://runtimerebel.com/blog/blackfile-analyzing-unc6671-vishing-cloud-data-extortionExamines UNC6671's BlackFile vishing, AiTM, and cloud data exfiltration tactics against Microsoft 365 & Okta. Actionable mitigations included.Fri, 15 May 2026 20:32:33 GMTUNC6671BlackFileVishingAitMMicrosoft 365OktaSharePointOneDriveData ExfiltrationExtortionSocial Engineeringhttps://runtimerebel.com/blog/aitm-phishing-attacks-target-us-organizations-with-conduct-reportshttps://runtimerebel.com/blog/aitm-phishing-attacks-target-us-organizations-with-conduct-reportsMicrosoft warns of a sophisticated AitM phishing campaign using fake conduct reports to bypass MFA and hijack Microsoft 365 user sessions.Tue, 05 May 2026 16:40:58 GMTPhishingAitMMicrosoft 365Session HijackingCredential Thefthttps://runtimerebel.com/blog/tycoon-2fa-market-shift-fragmentation-and-the-rise-of-dadsechttps://runtimerebel.com/blog/tycoon-2fa-market-shift-fragmentation-and-the-rise-of-dadsecAnalysis of Tycoon 2FA's declining market share as threat actors reuse its technical artifacts in Dadsec and other phishing-as-a-service platforms.Sat, 18 Apr 2026 12:18:24 GMTTycoon 2FADadsecPhishing as a ServiceAitMMFA Bypasshttps://runtimerebel.com/blog/aitm-phishing-campaign-targets-tiktok-business-via-turnstile-evasionhttps://runtimerebel.com/blog/aitm-phishing-campaign-targets-tiktok-business-via-turnstile-evasionSecurity researchers have identified a sophisticated AitM phishing campaign using Cloudflare Turnstile to hijack TikTok for Business accounts for malvertising.Fri, 27 Mar 2026 16:23:55 GMTTiktokAitMPhishingCloudflare TurnstileMalvertisingCredential Hijackinghttps://runtimerebel.com/blog/tycoon-2fa-paas-recovery-detecting-aitm-phishing-infrastructurehttps://runtimerebel.com/blog/tycoon-2fa-paas-recovery-detecting-aitm-phishing-infrastructureTycoon 2FA Phishing-as-a-Service has recovered from law enforcement disruption. Learn how this AitM platform bypasses MFA and how to protect your organization.Mon, 23 Mar 2026 12:24:24 GMTTycoon 2FAAitMPhishing as a ServiceMFA BypassCredential Thefthttps://runtimerebel.com/blog/tycoon-2fa-phaas-infrastructure-dismantled-in-europol-led-operationhttps://runtimerebel.com/blog/tycoon-2fa-phaas-infrastructure-dismantled-in-europol-led-operationEuropol and global law enforcement dismantle Tycoon 2FA, a Phishing-as-a-Service kit used in 64,000 attacks to bypass MFA via AitM techniques.Thu, 05 Mar 2026 08:16:06 GMTTycoon 2FAEuropolPhishing as a ServiceMFA BypassAitMhttps://runtimerebel.com/blog/tycoon-2fa-phaas-platform-dismantled-in-global-law-enforcement-takedownhttps://runtimerebel.com/blog/tycoon-2fa-phaas-platform-dismantled-in-global-law-enforcement-takedownInternational law enforcement dismantled Tycoon 2FA, a Phishing-as-a-Service platform used to bypass MFA and target 500,000 organizations monthly.Wed, 04 Mar 2026 20:15:37 GMTTycoon 2FAPhishing as a ServiceMFA BypassAitMEuropolhttps://runtimerebel.com/blog/starkiller-phishing-as-a-service-technical-analysis-of-adversary-in-the-middle-frameworkshttps://runtimerebel.com/blog/starkiller-phishing-as-a-service-technical-analysis-of-adversary-in-the-middle-frameworksAn examination of the Starkiller phishing platform, which employs transparent reverse proxy techniques to relay authentication traffic and capture multi-factor…Mon, 23 Feb 2026 08:20:40 GMTPhishingMFA BypassAitMPhaaSCredential Theft