# Inside Knight Office, a New M365 AiTM Phishing Kit

Knight Office AiTM kit relays M365 logins via device-code phishing to steal session tokens, then enrolls rogue WHfB keys for persistence.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2026-09-02
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/inside-knight-office-m365-aitm-attack
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack
- Tags: area:cloud domain:cloud impact:ato impact:internal-access kind:incident platform:threat-intel sev:high tech:azure tech:oidc technique:recon vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass

**Target:** Microsoft Entra ID / M365 authentication (device code flow, WHfB)
**Root cause:** Victim is lured into pasting an attacker-supplied device-auth code into Microsoft's real login, granting the attacker a token; captured session tokens are then replayed and a rogue device/WHfB key is enrolled for persistence.
**Steps:**
1. Send DocuSign-style self-spoofed email with subject `Reminder: Signature Required - Approval Pending Your Review!!! Ref ID-<random>`
2. Link routes through Monday.com tracking redirect to a compromised Joomla site, then to phishing page
3. Page displays a nine-letter deviceauth code and a `Sign In With Microsoft` button
4. Button opens Microsoft's deviceauth login in a new tab; victim pastes code and completes credentials + MFA push
5. Attacker replays captured session tokens via `python-requests/2.34.2`, `OAuth2:Token` User-Agent from data center hosting ranges
6. Attacker enrolls unauthorized host into Entra ID, registers rogue device, binds WHfB key (`Dsreg/10.0 (Windows 10.0.19044.1826)`)
7. Attacker signs in via WHfB passwordless auth to regain access after token revocation
**How found:** SOC flagged two post-MFA auth events to Microsoft Authentication Broker from a Comcast IP flagged by Spur as a callback proxy; pivoted on IP 104.37.188[.]94 (linked to token replays) in Validin, found the Knight Office operator console, then used VirusTotal and SAT telemetry to map related domains and lures.
**Exploitation:** Precondition: victim completes device-code auth and MFA. Attacker replays stolen tokens from callback-proxy/data-center IPs (104.37.188[.]94, Tencent Cloud ranges) to authenticate as the user without password attempts, then enrolls attacker-controlled device and WHfB credential to persist past token revocation.
**Escalation:** Token replay -> rogue Entra device registration -> WHfB key binding, converting transient session theft into durable passwordless persistence.
**Insight:** Callback-proxy IPs on the token-callback leg (vs. victim IP on initial request) are a reliable AiTM signal; pivot on replay IPs in passive DNS/threat-intel to find operator consoles and sibling .vu domains.