Frameless BitB

Proofpoint linked the activity to credential-phishing campaigns aimed at researchers... with lures designed to steal access to their cloud accounts.

The link ultimately led to a fake OneDrive AitM credential phishing page designed to gain access to the target’s cloud account.

If the target replied, TA419 followed up with a shortened URL that purported to share additional information. The link ultimately led to a fake OneDrive AitM credential phishing page.

TA419 impersonated prominent figures and a senior Anthropic employee in apparently harmless collaboration emails, then directed recipients through a multi-stage URL redirection chain to a credential-phishing attack.

Clicking a document, or OneDrive’s own prompt to sign in, opens a fake Chrome login window drawn inside the page.

The link ultimately led to a fake OneDrive AitM credential phishing page designed to gain access to the target’s cloud account.

The link ultimately led to a fake OneDrive AitM credential phishing page designed to gain access to the target’s cloud account.

The campaign spoofed Lynne Edwards Parker, Heidi Crebo-Rediker, and a senior Anthropic employee; the landing page performed a Cloudflare Turnstile check behind a phony OneDrive loading screen.

The group occasionally registers domains that impersonate specific organizations like heritiages[.]org and heritiage[.]org for the Heritage Foundation.

The link ultimately led to a fake OneDrive AitM credential phishing page designed to gain access to the target’s cloud account.

Because it forwards the victim's Microsoft 365 login to Microsoft in real time, the password, multifactor authentication (MFA) code and conditional access checks all pass.

A counterfeit Microsoft login pop-up placed over a OneDrive-lookalike page relayed the login to genuine Microsoft infrastructure, allowing harvesting of Microsoft 365 passwords, MFA codes, and session cookies.

A custom script built into the kit reports the victim’s progress to the attackers, gives them a live view of the session, accepts the “Keep me signed in” prompt and submits one-time codes as soon as they validate.

The phishing page relayed the login to genuine Microsoft infrastructure, allowing the harvesting of Microsoft 365 passwords, MFA codes, and session cookies.

Credentials entered in that window are relayed to Microsoft’s servers, so the password, the MFA code and conditional access checks would all go through.

The attack combined adversary-in-the-middle, or AitM, phishing with a modified Frameless BitB toolkit... the proxy relayed the genuine Microsoft sign-in process while adding malicious scripts.

A custom module, /secondary/observe.js, tracked each target’s progress through authentication. It also automatically accepted “Keep me signed in” and submitted validated one-time codes.

This allowed supported password and MFA steps to complete while the attacker captured the resulting session cookies.

Because it forwards the victim's Microsoft 365 login to Microsoft in real time, the password, multifactor authentication (MFA) code and conditional access checks all pass.

A counterfeit Microsoft login pop-up placed over a OneDrive-lookalike page relayed the login to genuine Microsoft infrastructure, allowing harvesting of Microsoft 365 passwords, MFA codes, and session cookies.

Frameless BitB ... contains a Browser-in-the-Browser (BitB) overlay [and] an Evilginx phishlet to intercept usernames, passwords, and session cookies for Microsoft 365.

Credentials entered in that window are relayed to Microsoft’s servers, so the password, the MFA code and conditional access checks would all go through.

The attack combined adversary-in-the-middle, or AitM, phishing with a modified Frameless BitB toolkit... the proxy relayed the genuine Microsoft sign-in process while adding malicious scripts.