# Adversary-in-the-middle (AiTM)

Published articles for Adversary-in-the-middle (AiTM).

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Detect and disrupt AI-themed attacks with Microsoft Defender

DevFeed: [Detect and disrupt AI-themed attacks with Microsoft Defender](<https://devfeed.tech/articles/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender-7644.md>)

Original publisher: [Read original article](<https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/>)

Author: Rob Lefferts

Published: 2026-09-10T16:00:00Z

Content type: article

Language: en

Sources: [Microsoft Security Blog](<https://devfeed.tech/sources/microsoft-security-blog.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [spoofing](<https://devfeed.tech/topics/spoofing.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>)

Tags: [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [ai](<https://devfeed.tech/tags/ai.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [chatgpt](<https://devfeed.tech/tags/chatgpt.md>), [claude](<https://devfeed.tech/tags/claude.md>), [copilot](<https://devfeed.tech/tags/copilot.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [deepseek](<https://devfeed.tech/tags/deepseek.md>), [defender](<https://devfeed.tech/tags/defender.md>), [github](<https://devfeed.tech/tags/github.md>), [malware](<https://devfeed.tech/tags/malware.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>)

### AI overview

Microsoft describes AI-themed phishing, malvertising, credential theft, and malware campaigns that impersonate popular AI services and tools. It argues that attackers are exploiting trust and urgency around AI brands rather than compromising the referenced services.

### Source excerpt

See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post Detect and disrupt AI-themed attacks with Microsoft Defender appeared first on Microsoft Security Blog.

## Passkey-themed social engineering leads to identity and cloud compromise

DevFeed: [Passkey-themed social engineering leads to identity and cloud compromise](<https://devfeed.tech/articles/passkey-themed-social-engineering-leads-to-identity-and-cloud-compromise-7642.md>)

Original publisher: [Read original article](<https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/>)

Author: Microsoft Security Research, Krithika Ramakrishnan, Bharat Vaghela, Vaibhav Deshmukh, Subhajit Ghosh, Anusha Chakraborty, Akash Chaudhuri, Victor Chingtham and Ivan Macalintal

Published: 2026-09-09T17:41:18Z

Content type: article

Language: en

Sources: [Microsoft Security Blog](<https://devfeed.tech/sources/microsoft-security-blog.md>)

Topics: [MFA](<https://devfeed.tech/topics/mfa.md>), [data-processing](<https://devfeed.tech/topics/data-processing.md>)

Tags: [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [apis](<https://devfeed.tech/tags/apis.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [data](<https://devfeed.tech/tags/data.md>), [identity](<https://devfeed.tech/tags/identity.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>)

### AI overview

Microsoft Security Research describes a passkey-themed social-engineering campaign that compromises cloud identities through AiTM phishing or device-code flows, establishes authentication persistence, and collects cloud data. It outlines investigation signals and recommends revoking sessions and removing unauthorized authentication methods after confirmed compromise.

### Source excerpt

Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance. The post Passkey-themed social engineering leads to identity and cloud compromise appeared first on Microsoft Security Blog.

## Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond

DevFeed: [Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond](<https://devfeed.tech/articles/behind-the-console-an-aitm-phishing-kit-harvesting-aws-console-credentials-and-beyond-8279.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/>)

Author: Datadog

Published: 2026-06-24T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Adversary-in-the-middle (AiTM)](<https://devfeed.tech/topics/adversary-in-the-middle-aitm.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [VirusTotal](<https://devfeed.tech/topics/virustotal.md>), [Batch file](<https://devfeed.tech/topics/batch-file.md>), [cURL](<https://devfeed.tech/topics/curl.md>), [Amazon Route 53](<https://devfeed.tech/topics/amazon-route-53.md>)

Tags: [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [aws](<https://devfeed.tech/tags/aws.md>), [batch](<https://devfeed.tech/tags/batch.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [dns](<https://devfeed.tech/tags/dns.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [security](<https://devfeed.tech/tags/security.md>), [virustotal](<https://devfeed.tech/tags/virustotal.md>)

### AI overview

Datadog Security Research analyzes a June 2026 campaign using cloned AWS console login pages and adversary-in-the-middle techniques to harvest credentials and MFA codes. The article details the phishing infrastructure, delivery methods, VirusTotal artifact, and JavaScript-based credential-harvesting flow.

### Source excerpt

Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes.