Global analysis of Adversary-in-the-Middle phishing threats

This Sekoia TDR report analyzes the rising threat of Adversary-in-the-Middle (AitM) phishing and the Phishing-as-a-Service (PhaaS) ecosystem (e.g., Tycoon 2FA, EvilProxy, NakedPages, Mamba 2FA), describing how reverse-proxy and synchronous relay kits harvest credentials and session cookies to bypass MFA, enabling Business Email Compromise, financial fraud, and espionage; it summarizes common lures, anti-bot and redirection techniques, prevalence of major kits (Jan–Apr 2025), detection/hunting methodologies, and actionable telemetry and IoCs for SOCs and CERTs.