Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress investigated an August AiTM phishing campaign using the Knight Office phishing kit that captured Microsoft session tokens via DocuSign-style lures, trusted redirects, and callback proxies; attackers replayed tokens from infrastructure (including 104.37.188.94 and Tencent Cloud ranges), enrolled rogue devices into Microsoft Entra ID, and bound Windows Hello for Business keys to maintain persistent access. The report includes telemetry, multiple IOCs (IP addresses, domains, user agents, Cloudflare sitekey), detection guidance, and MITRE ATT&CK technique mappings.