Summary
- Knight Office uses adversary-in-the-middle techniques to steal authenticated Microsoft 365 session tokens.
- Huntress observed an attacker registering a rogue Entra device and binding a Windows Hello for Business credential after compromise.
- Successful MFA does not establish that the resulting cloud session remains under the legitimate user's control.
Huntress has documented a phishing operation it calls Knight Office that steals authenticated Microsoft 365 sessions and, in one investigated case, established additional persistence through Microsoft Entra device registration.
The security company encountered the operator console while investigating suspicious Microsoft 365 authentication activity on 18 August. The incident began with a DocuSign-style phishing message and used several redirects before delivering the victim to the attacker’s authentication flow.
Huntress said the redirect chain included a Monday.com tracking service and a compromised Joomla website, helping conceal the ultimate phishing destination from reputation systems and analysts inspecting the original message.
The attack then used an adversary-in-the-middle process to capture session tokens after the victim completed authentication. Rather than defeating multifactor authentication cryptographically, the attacker obtained the authenticated session created after the legitimate user had completed it.
In the case examined by Huntress, the activity continued after initial access. The attacker enrolled an unauthorised host into Microsoft Entra ID, completed a rogue device registration, and bound a Windows Hello for Business key credential to the account.
Those actions turn a phishing event into a broader identity-governance problem. Preventing the initial message from succeeding remains important, but once an authenticated session has been stolen, the controls governing device enrolment, credential registration, and post-authentication changes become equally significant.
Huntress linked at least nine token-replay logins in its telemetry to Knight Office over a two-week period. It also found hundreds of reported emails using the same message template dating back to April, although those messages do not establish that every recipient was successfully compromised.
The campaign shows why MFA adoption metrics can overstate the strength of an identity environment when viewed in isolation. An account can have MFA enabled and the user can complete it correctly while an attacker still acquires the session created afterwards.
Cloud-session security consequently depends on more than the login event. Device trust, conditional-access rules, token protections, authentication-method governance, session monitoring, and restrictions on credential registration influence how far an attacker can move after obtaining a valid session.
The use of legitimate services in the redirect chain creates another challenge. Controls that judge a link primarily through the reputation of its first destination can be weakened when attackers route victims through trusted infrastructure before reaching a compromised or attacker-controlled site.
Knight Office also fits a wider shift in phishing tooling towards token theft rather than conventional password collection. Huntress compared it with other phishing services focused on adversary-in-the-middle session theft and device-code or OAuth token abuse.
That evolution follows the defensive gains from widespread MFA deployment. As passwords become less useful on their own, the authenticated session and the ability to register trusted identity artefacts become more valuable targets.
Huntress has not attributed Knight Office to a named criminal group. Its research establishes the infrastructure and behaviour seen in the incidents it investigated, but not the identity of the operator.
The technical conclusion is nevertheless clear: successful MFA does not guarantee continued control of the resulting session, and post-authentication changes inside the identity platform can determine whether a phishing compromise becomes persistent.
