Smuggler’s Gambit: Uncovering HTML Smuggling Adversary in the Middle Tradecraft | Huntress

Huntress discovered a phishing campaign that weaponizes HTML smuggling to deliver a locally opened HTML file which dynamically injects a transparently proxied iframe of the legitimate Outlook login page; this Adversary-in-the-Middle proxy can capture credentials, session tokens, and bypass MFA. The report includes IoCs (domains and a payload hash), ATT&CK mappings, and remediation guidance; Huntress has submitted takedowns and warns that the technique is novel and likely widespread.