New research has shown that EvilProxy is maintaining its status as a popular platform for targeting multi-factor authentication (MFA) enabled accounts. Proofpoint researchers have seen over 120,000 phishing emails sent to Microsoft 365 accounts associated with 100 different organizations. This threat is using both Adversary-in-the-Middle phishing and other advanced techniques to bypass the increasing use of multifactor authentication. The proliferation of MFA phishing kits has created a market where even people with typically low levels of hacking skills can, for a small price, perform effective and efficient phishing attacks. The initial attack chain commences with the attacker impersonating known and trusted services such as DocuSign or Adobe. After the user clicks on the malicious link, the traffic is redirected using a combination of legitimate redirectors, malicious cookies, and 404 redirects. This eventually ends with the user landing on an EvilProxy phishing framework page that mimics the branding of the impersonated entity. Users submit their Microsoft 365 credentials from there and within seconds of an account compromise, the threat actors were entering the victim’s Microsoft 365 account. The threat actors appear to be specifically targeting the highest level they can reach within an organization, generally C-level executives, and directors. Once the threat actor has gained access, the native Microsoft application “My Sign-Ins” is used to add another multi-factor authentication method controlled by the threat actor, giving them persistent access. The threat actors can then move laterally and escalate throughout the organization, embedding further malware within localized and cloud systems.