The Procurement Trap: Inside an AiTM Campaign Targeting Global Institutions

This report documents an active adversary‑in‑the‑middle (AiTM) phishing campaign targeting universities, enterprises, and international institutions (including EU and UN agencies) that leverages compromised, aged domains and multiple AiTM kits (EvilProxy, FlowerStorm/Storm‑1167, Kali365) to proxy legitimate authentication flows, capture session tokens and MFA responses, and establish authenticated sessions; the report describes the phishing lures, impersonated download/auth portals, RDGA/domain patterns, and provides a set of indicators and detection guidance emphasizing DNS/RDGA analysis.