The Procurement Trap: Inside an AiTM Campaign Targeting Global Institutions

This report analyzes an active adversary-in-the-middle (AiTM) phishing campaign targeting universities, enterprises, and international organizations. The actor compromises aged domains and injects PHP-based fake document portals, then uses staged interactions and multiple PhaaS AiTM kits (EvilProxy, FlowerStorm/Storm-1167, Kali365) to capture credentials, MFA tokens, and session cookies—enabling authenticated session takeover; the report provides indicators and domain patterns useful for detection.