AITM phishing with Russian infrastructure and detection evasion from a lapsed domain · Blog · Sublime Security

Sublime Threat Research analyzes a targeted credential-phishing campaign that used a reclaimed legitimate law firm domain to send Microsoft Teams-style meeting invites linking to a sophisticated, multi-stage phishing infrastructure. The chain includes a gate page performing bot and domain checks, custom email encoding/decoding, large obfuscated JavaScript modules (with WebSocket and WebAssembly usage) for fingerprinting and control, and a final adversary-in-the-middle Office 365 login page to harvest credentials; the report includes IOCs and detection guidance.