Cookie Heist: AiTM Session Theft to Payment-Fraud BEC
An adversary-in-the-middle phishing intrusion that turns into payment fraud without any malware. A voicemail-themed email with an HTML attachment routes a finance analyst through a redirector to an Evilginx2 proxy, which relays her real Microsoft 365 sign-in and steals the post-MFA session cookie. The attacker replays the cookie from a foreign hosting IP, bypassing MFA, then reads her mailbox, creates an email-hiding inbox rule keyed on a vendor's domain, deletes the phishing mail, and replies inside a live invoice thread asking the vendor to wire payment to a new account. Work the Entra sign-in audit, the Exchange Online mailbox operations, and the email evidence to reconstruct the chain.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Locate the compromised identity
35One cloud account signed in twice within minutes, once normally and once from abroad. Identify the account that was taken over.
Pin the cookie-replay source
35The MFA bypass came from reusing a stolen session, not a password. Identify the external IP that replayed the session cookie.
Find the email-hiding inbox rule
35The attacker hid the vendor's replies so the fraud could proceed. Identify the sender domain the malicious inbox rule keys on.
Recover the fraudulent account details
30The attacker's end goal was a redirected wire. Identify the IBAN inserted into the vendor invoice thread.
Classify the MFA-bypass technique
35Name how the attacker defeated MFA. Map the stolen, replayed session to its MITRE ATT&CK technique.
Classify the email-hiding technique
35Name what the inbox rule was for. Map the rule that buries the vendor's replies to its MITRE ATT&CK technique.
7 tasks · 205 points total
Training Tools
Email Console
Email header & content analysis
SIEM Console
Log analysis & SPL queries
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Email concepts
- Familiarity with SIEM concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allIllicit OAuth App-Consent Grant: Entra ID Impersonation Campaign
A mass illicit OAuth app-consent campaign against a maritime logistics tenant. Operators register multitenant Entra apps impersonating trusted SaaS brands (iLSMART, Adobe, DocuSign, OneDrive-2025) and send brand-themed consent lures from compromised supplier accounts. Victims who click are screened by a Tycoon antibot redirector into an adversary-in-the-middle relay that proxies the real Entra sign-in, harvests the password, and intercepts the MFA-approved token. The replayed token completes user-level consent grants to the impersonation apps, which read mailboxes over Microsoft Graph, and the attacker registers a new MFA method for durable persistence. Work the Email lures and the Entra consent, sign-in, Graph, and security-info audit to reconstruct the chain.
Key Vault Contributor Privilege Escalation: Reading All Secrets via Access Policies
A holder of the built-in Key Vault Contributor role abuses its Microsoft.KeyVault/vaults/write permission to write itself a full data-plane access policy on a production Azure Key Vault, then dumps every secret, key, and certificate it holds. Working purely from the cloud audit trail, correlate the control-plane access-policy change in the Azure Activity Log with the data-plane secret, key, and certificate reads in the Key Vault diagnostic log, identify the principal and what it stole, and classify the privilege-escalation and credential-access techniques.
Mounted and Loaded: ISO Container Delivery of the Bumblebee Loader
An ISO image attachment hides a visible shortcut beside a hidden DLL. The user mounts the container and runs the shortcut, which executes the Bumblebee loader via rundll32 against a DLL export. Bumblebee injects into a signed Windows Mail binary through WMI, beacons HTTPS to a C2 cluster, then layers a Meterpreter stager and a Cobalt Strike beacon. The operator runs AdFind discovery, dumps LSASS with ProcDump, creates a rogue local admin, installs AnyDesk for fallback access, and moves laterally with a harvested domain administrator before the intrusion is contained pre-encryption. Reconstruct the kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.