Infoblox Threat Intel uncovers an operation that uses trusted business workflows, compromised websites and fake document portals to pursue high-value organizational access
DUBAI, UAE, July, 2026: Right now, someone may be sitting invisibly between your users and their login pages. They’re not guessing passwords or cracking MFA codes; they’re waiting for authentication to succeed, to hijack the session. Infoblox Threat Intel has uncovered a sophisticated adversary-in-the-middle (AiTM) phishing campaign targeting universities, enterprises and multinational institutions, including European Union and United Nations agencies.
The interesting angle of this attack is procurement-themed emails sent from previously compromised organizational accounts which make the messages appear credible. After a recipient clicks, this adversary-in-the-middle infrastructure intercepts credentials and authenticated session tokens in real time – even multi-factor authentication ones. This allows the attackers to bypass many of the controls organizations rely on to secure their identities.
For the recipient, the attack can look like an ordinary part of the workday: a bid invitation, a shared project file or a request for information. False deadlines and confidentiality language create urgency, while familiar-looking screens make it seem as though victims are accessing a document or signing in as usual. Behind the scenes, the attacker is using that trusted process to gain access to the organization’s account and network.
The actor appears to rotate among multiple phishing-as-a-service kits, including EvilProxy, FlowerStorm and Kali365, while using compromised, often dormant websites to host near-identical fake download pages. Those sites may look more trustworthy than newly created malicious domains, but their patterns, subdomain conventions and reused infrastructure can still expose the campaign to defenders.
“These actors are using trust in organizational processes, like purchases, to convince people to hand over their credentials,” said Dr. Renée Burton, Vice President of Infoblox Threat Intel. “It’s not a phishing scenario that you are usually warned about in security training.”
The findings reinforce the need for organizations to pair user awareness and identity controls with early visibility into the infrastructure behind phishing operations. DNS-based threat intelligence can help defenders identify campaign patterns upstream, before users reach fraudulent pages or attackers gain access to authenticated sessions.
Photo Caption: Dr. Renée Burton, Vice President of Infoblox Threat Intel
About Infoblox Threat Intel:
Infoblox Threat Intel is the leading creator of original DNS threat intelligence, distinguishing itself in a sea of aggregators. What sets us apart? Two things: mad DNS skills and unparalleled visibility. DNS is notoriously tricky to interpret and hunt from, but our deep understanding and unique access to the internet’s inner workings allows us to track down threat actors that others can’t see. We’re proactive, not just defensive, using our insights to disrupt cybercrime where it begins. We also believe in sharing knowledge to support the broader security community by publishing detailed research and releasing indicators on GitHub. In addition, our intel is seamlessly integrated into our Infoblox DNS Detection and Response solutions, so customers automatically get its benefits, along with ridiculously low false positive rates.
About Infoblox:
Infoblox is a leading platform for preemptive security and hybrid, multi-cloud networking that delivers enterprise resilience and agility. Trusted by over 5,700 customers, including the majority of Fortune 100 companies as well as emerging innovators, we seamlessly integrate, secure and automate critical network services so businesses can move fast without compromise.
