AiTM Phishing Traffic to PREY-0058 M365 Credential Proxy IP

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•5

Detects network activity indicating interaction with known Adversary-in-the-Middle (AiTM) phishing infrastructure. This includes direct outbound connections to specific suspicious IP addresses and the identification of proxied Microsoft 365 OAuth authorization flows redirected to non-Microsoft hosts.