# Smuggler’s Gambit | Huntress

Mass phishing campaign uses HTML smuggling to inject an iframe of a transparently proxied Outlook login, stealing session tokens and bypassing MFA.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Outlook
- Credited: Huntress
- Disclosed: 2024-05-23
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft
- Tags: domain:web impact:ato kind:incident platform:threat-intel sev:high tech:email technique:chained technique:recon vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass

**Target:** Outlook/OWA login portal via attacker-controlled transparent proxy domains
**Root cause:** HTML smuggling payload uses document.write() to inject an iframe of the legitimate Outlook login portal fetched from attacker infrastructure that transparently proxies authentication, capturing session tokens.
**Steps:**
1. Deliver HTML file (e.g. `[ORG] remittance 05212024.html`) to victim via phishing email
2. Opening file runs base64-decoded `document.write()` calls that render an iframe pointing at `hxxps://rnsnno.<attacker-domain>/?qrc=<base64 email>`
3. Proxy returns branded Outlook login page with username pre-filled via `login_hint`
4. Victim submits password and MFA code through the proxied iframe
5. Attacker captures resulting session token and replays it in own browser
**How found:** Huntress IDR telemetry flagged three same-subdomain `.pro` domains registered the day prior; web root redirected to example.com; VirusTotal relations surfaced an HTML payload contacting the domains; inspecting the base64 document.write() blocks revealed an injected iframe, and injecting a test username into the `?qrc=` parameter produced a user-specific login page, proving a transparent proxy rather than a clone.
**Exploitation:** Victim opens locally-stored HTML, iframe loads proxied Outlook login from attacker domain; credentials and MFA flow through the proxy, yielding a session token the attacker injects into their own browser to authenticate as the victim without MFA.
**Insight:** Test whether a suspected phishing page is a clone or a live proxy by injecting an arbitrary identifier (email/username) into its URL parameters and checking if the returned page personalizes; a clone cannot, a transparent proxy will.