Executive Summary
Researchers have identified a new phishing kit named Knight Office, designed to conduct Adversary-in-the-Middle (AiTM) attacks against Microsoft 365 and Google Workspace identities. The kit operates via a Flask-based management console (hosted at 104.37.188[.]94) that allows attackers to monitor live victim sessions, deploy custom phishing links, and manage stolen session tokens in real time.
The attack chain typically begins with a DocuSign-themed lure that leverages multiple redirects, including the Monday[.]com tracking service and compromised Joomla sites, to evade reputation scanners. By hijacking legitimate session tokens after the user completes MFA, attackers can bypass traditional authentication controls and maintain persistence by enrolling rogue devices and binding Windows Hello for Business (WHfB) credentials to the compromised accounts.
This kit represents a significant threat to organizational identity security as it sidesteps MFA protections entirely. Evidence suggests the campaign has been active since at least April 2026, with hundreds of reported phishing emails and multiple successful account compromises linked to the infrastructure.