Global analysis of Adversary-in-the-Middle phishing threats

This abridged Sekoia TDR report analyzes the accelerating use of Adversary-in-the-Middle (AitM) phishing against Microsoft 365 and Google accounts, driven by a maturing Phishing-as-a-Service ecosystem; it outlines evolving delivery trends (QR to HTML to SVG attachments), layered redirection and anti-bot techniques, and BEC monetization, and presents telemetry-informed monitoring/detection approaches (infrastructure heuristics, Entra ID log analytics) alongside a Q1 2025 ranking of leading AitM kits—led by Tycoon 2FA, Storm-1167, NakedPages, Sneaky 2FA, EvilProxy, and Evilginx—to guide detection, tracking, and response.