Phishing in the Dark: A Case Study of AzureAiTMFunction Exploitation 

Threat actors have continued to find new ways to phish for session tokens in business email compromise (BEC) attacks. One growing trend involved abuse of the Axios user agent within adversary-in-the-middle (AiTM) phishing campaigns.

Axios is a promise-based HTTP client for Node.js. While it is a legitimate developer tool, threat actors abuse it to proxy login requests from the legitimate account owner. The Blackpoint SOC observed a large increase in phishing campaigns using this user agent across multiple clients.

In one incident, the Blackpoint SOC responded to a compromise where a threat actor phished a user account using AzureAiTMFunction.

What Is AzureAiTMFunction?

AzureAiTMFunction is an open-source GitHub project that leverages Azure Functions for user phishing. It creates a serverless phishing toolkit that is more opsec-friendly than a typical phishing kit because it requires fewer resources.

The project abused Azure Function Applications to host Microsoft-lookalike phishing pages. Analysis of its source code found that it leveraged the Axios framework for the adversary-in-the-middle and session-hijacking portions of the toolkit.

What This Attack Reveals About AiTM Phishing

• Threat actors continue to adapt their tactics, techniques, and procedures (TTPs) within phishing campaigns.
• Threat actors are moving toward serverless methods for their phishing toolkits.
• Credentials are not always the focus. Attackers increasingly aim to hijack and replay session tokens.

Inside the AzureAiTMFunction Attack

A recent incident handled by the Blackpoint SOC involved AzureAiTMFunction. A threat actor leveraged this open-source toolkit within a phishing campaign, and the investigation surfaced the following findings.

Serverless Hosting & Session Relay

The threat actor hosted the function app out of Switzerland. When the user fell for the phishing email, the threat actor used the toolkit to relay the hijacked session token to an RDP jump box.

A Jump Box With a Suspicious Certificate

RDP jump boxes are virtual private servers (VPS) that threat actors spin up to access compromised cloud accounts. The Blackpoint SOC calls them jump boxes because they are typically a hop that threat actors use to further obfuscate their logins. These jump boxes usually have RDP publicly exposed, which is the preferred connection method for a threat actor.

The CN (common name) associated with the certificate for these RDP jump boxes is typically abnormal, which is a telltale sign that the infrastructure is being used for malicious purposes. For this incident, checking Censys showed the CN as “safenet”, which did not align with legitimate business purposes for the organization.

Authentication From an Anomalous Location

After relaying the session to the jump box, the threat actor used the stolen session to authenticate from Nigeria.

Post-Compromise OAuth Abuse

During the post-exploitation phase of this business email compromise (BEC), the threat actor consented to the Azure application eM Client. eM Client is a legitimate application that threat actors abuse in BEC cases to exfiltrate mail and contact information. Attackers use the contacts in the victim’s address book as targets in future phishing campaigns.

The Blackpoint SOC quickly identified the compromise and contained the account. The kill chain for this incident highlights the continuous use of new tools and techniques within these attacks.

What to Monitor for Axios & AiTM Activity

These signals are not, by themselves, confirmation of compromise, but reviewed together they can point toward AiTM activity that deserves a closer look:

• Unexpected Axios user-agent strings (for example, axios/1.x.x) in sign-in logs
• A user-agent that changes to Axios mid-session while the session ID stays the same, which can indicate a replayed token
• Sign-ins from unfamiliar or geographically anomalous locations, or impossible-travel activity
• New or unusual OAuth application consents, such as mail clients used for exfiltration
• Newly created mailbox rules or unexpected mail forwarding
• Connections involving VPS or RDP jump-box infrastructure with abnormal certificate common names

See how Blackpoint’s Managed Detection & Response and Identity Threat Detection & Response help MSPs monitor for this kind of activity across client environments.

Recommendations to Combat AiTM

Threat actors will continue to evolve their methods for phishing attacks that use functions such as AzureAiTMFunction. Defending against these threats takes a multi-layered approach:

• Prioritize comprehensive user education and security awareness training.
• Implement phishing-resistant authentication mechanisms.
• Rigorously test and fine-tune Conditional Access Policies to strengthen access controls.
• Deploy advanced detection and response for cloud environments, such as Blackpoint’s Cloud Response, for rapid detection and mitigation.

Protect Your Clients From AiTM Attacks

AiTM toolkits like AzureAiTMFunction show how quickly attackers adopt serverless infrastructure and session-hijacking techniques to slip past MFA. Layered controls reduce the risk, but the difference between a contained incident and a full business email compromise often comes down to how fast the activity is detected and shut down.

Want to strengthen threat detection and response across your client environments? Contact our team to get started.