Date: 09/03/2026
Severity: High
Summary
During an August investigation into an Adversary-in-the-Middle (AiTM) attack, researchers discovered the control panel of a phishing kit known as Knight Office. The attack began with a DocuSign-themed email lure, followed by multiple redirects through the Monday work management platform and a compromised Joomla website. Victims were ultimately directed to a phishing page where their valid session tokens were captured and sent to the Knight Office console. These stolen tokens enabled attackers to access victim accounts as authenticated users without requiring passwords or bypassing multi-factor authentication (MFA).
Indicators of Compromise (IOC) List
Domains/URLs | idoej.com advancedplacyncement.vu amstardmzsmc.vu arandasoftzfdware.vu avisoretentiunionllc.vu capitalflwxinancialpartners.vu certififiycationedge.vu connectivnqzityltd.vu crrbcearegroup.vu digitaltrafwwrficsystems.vu exceltecbusinessbwpsolutions.vu genamewwgdiamarketing.vu globaieflsoftinc.vu globalmixeucbdmodetechnologyinc.vu globalprojectspvtltd.vu joinbusinessmanagementconsdjeulting.vu kentmanqhfufacturingcompany.vu kleepxrnlinecorporation.vu knsinternacshtional.vu monttmmlrustcompany.vu mtprormtductions.vu realestatecotblrp.vu siottxgroup.vu summitcapitaltrapojininggroup.vu techcompositnkoes.vu techromixsolutionlonsinc.vu |
IP Address | 154.127.53.78 104.37.188.94 |
Subjectline | Reminder: Signature Required - Approval Pending Your Review!!! Ref ID-<RANDOM> |
Cloudflare Turnstile Sitekey | 0x4AAAAAADrkE-VuOnNDfr6W |
User Agent | Dsreg/10.0 (Windows 10.0.19044.1826) |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "capitalflwxinancialpartners.vu" or url like "capitalflwxinancialpartners.vu" or siteurl like "capitalflwxinancialpartners.vu" or domainname like "summitcapitaltrapojininggroup.vu" or url like "summitcapitaltrapojininggroup.vu" or siteurl like "summitcapitaltrapojininggroup.vu" or domainname like "mtprormtductions.vu" or url like "mtprormtductions.vu" or siteurl like "mtprormtductions.vu" or domainname like "certififiycationedge.vu" or url like "certififiycationedge.vu" or siteurl like "certififiycationedge.vu" or domainname like "globalprojectspvtltd.vu" or url like "globalprojectspvtltd.vu" or siteurl like "globalprojectspvtltd.vu" or domainname like "advancedplacyncement.vu" or url like "advancedplacyncement.vu" or siteurl like "advancedplacyncement.vu" or domainname like "monttmmlrustcompany.vu" or url like "monttmmlrustcompany.vu" or siteurl like "monttmmlrustcompany.vu" or domainname like "joinbusinessmanagementconsdjeulting.vu" or url like "joinbusinessmanagementconsdjeulting.vu" or siteurl like "joinbusinessmanagementconsdjeulting.vu" or domainname like "digitaltrafwwrficsystems.vu" or url like "digitaltrafwwrficsystems.vu" or siteurl like "digitaltrafwwrficsystems.vu" or domainname like "connectivnqzityltd.vu" or url like "connectivnqzityltd.vu" or siteurl like "connectivnqzityltd.vu" or domainname like "idoej.com" or url like "idoej.com" or siteurl like "idoej.com" or domainname like "techromixsolutionlonsinc.vu" or url like "techromixsolutionlonsinc.vu" or siteurl like "techromixsolutionlonsinc.vu" or domainname like "kleepxrnlinecorporation.vu" or url like "kleepxrnlinecorporation.vu" or siteurl like "kleepxrnlinecorporation.vu" or domainname like "exceltecbusinessbwpsolutions.vu" or url like "exceltecbusinessbwpsolutions.vu" or siteurl like "exceltecbusinessbwpsolutions.vu" or domainname like "globaieflsoftinc.vu" or url like "globaieflsoftinc.vu" or siteurl like "globaieflsoftinc.vu" or domainname like "amstardmzsmc.vu" or url like "amstardmzsmc.vu" or siteurl like "amstardmzsmc.vu" or domainname like "avisoretentiunionllc.vu" or url like "avisoretentiunionllc.vu" or siteurl like "avisoretentiunionllc.vu" or domainname like "genamewwgdiamarketing.vu" or url like "genamewwgdiamarketing.vu" or siteurl like "genamewwgdiamarketing.vu" or domainname like "techcompositnkoes.vu" or url like "techcompositnkoes.vu" or siteurl like "techcompositnkoes.vu" or domainname like "kentmanqhfufacturingcompany.vu" or url like "kentmanqhfufacturingcompany.vu" or siteurl like "kentmanqhfufacturingcompany.vu" or domainname like "realestatecotblrp.vu" or url like "realestatecotblrp.vu" or siteurl like "realestatecotblrp.vu" or domainname like "arandasoftzfdware.vu" or url like "arandasoftzfdware.vu" or siteurl like "arandasoftzfdware.vu" or domainname like "crrbcearegroup.vu" or url like "crrbcearegroup.vu" or siteurl like "crrbcearegroup.vu" or domainname like "siottxgroup.vu" or url like "siottxgroup.vu" or siteurl like "siottxgroup.vu" or domainname like "globalmixeucbdmodetechnologyinc.vu" or url like "globalmixeucbdmodetechnologyinc.vu" or siteurl like "globalmixeucbdmodetechnologyinc.vu" or domainname like "knsinternacshtional.vu" or url like "knsinternacshtional.vu" or siteurl like "knsinternacshtional.vu" |
Detection Query 2 : | dstipaddress IN ("154.127.53.78","104.37.188.94") or srcipaddress IN ("154.127.53.78","104.37.188.94") |
Reference:
https://www.huntress.com/blog/inside-knight-office-m365-aitm-attack