AiTM - Captcha Evasion Gateway (T1566)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

Identifies users accessing Cloudflare Turnstile or reCAPTCHA gateways immediately preceding the AiTM proxy domain resolution. This behavior is indicative of an adversary-in-the-middle (AiTM) phishing attack attempting to bypass CAPTCHA challenges.