Full Report
SessionShark phishing kit bypasses Office 365 MFA by stealing session tokens. Experts warn of real-time attacks via fake…
Analysis Summary
# Tool/Technique: SessionShark Phishing Kit
## Overview
SessionShark is a recently discovered phishing kit specifically designed to steal login credentials for Microsoft Office 365, with a key capability being the bypass of Multi-Factor Authentication (MFA) by stealing active session tokens. It utilizes fake login pages and notifies operators via Telegram in real-time about successful compromises.
## Technical Details
- Type: Attack Tool (Phishing Kit)
- Platform: Targets web browsers accessing Microsoft Office 365 services.
- Capabilities: MFA token theft, real-time alerting via Telegram.
- First Seen: April 2025 (Based on article date)
## MITRE ATT&CK Mapping
*Note: As this is a phishing kit designed for credential theft and session hijacking, the primary mappings relate to Initial Access and Credential Access.*
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (Potentially via delivery mechanism)
- T1566.002 - Spearphishing Link (Likely mechanism)
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores (Applicable to session token capture)
## Functionality
### Core Capabilities
- Deploying highly convincing fake Microsoft Office 365 login pages to capture user credentials.
- Capturing active user session tokens after successful authentication (bypassing MFA).
- Real-time communication of successful compromises to the attacker via Telegram alerts.
### Advanced Features
- **MFA Bypass:** The primary advanced feature is the ability to steal session tokens, allowing attackers to hijack authenticated sessions without needing the MFA factor itself.
## Indicators of Compromise
- File Hashes: [Not specified in the provided text]
- File Names: [Not specified in the provided text]
- Registry Keys: [Not specified in the provided text]
- Network Indicators: [Not specified in the provided text, but involves communication to the kit infrastructure and eventually to Office 365 endpoints.]
- Behavioral Indicators: Redirection to attacker-controlled phishing pages; use of Telegram APIs for exfiltration/alerting.
## Associated Threat Actors
- Cyber criminals targeting Microsoft Office 365 users. (Specific named group not identified in the excerpt).
## Detection Methods
- Signature-based detection: [Not specified]
- Behavioral detection: Monitoring for user sessions being redirected through unusual proxy/phishing infrastructure before reaching legitimate Microsoft domains; detecting outbound alerts to known malicious infrastructure (like Telegram channels used for C2/alerts).
- YARA rules: [Not specified]
## Mitigation Strategies
- Prevention measures: User training specifically addressing MFA prompt fatigue and session hijacking techniques; rigorous examination of login URLs.
- Hardening recommendations: Enrolling users in phishing simulation exercises that mimic token-stealing attacks; enforcing strict conditional access policies that monitor for changes in session characteristics immediately following login.
## Related Tools/Techniques
- General Phishing Kits (e.g., various commercially available/leaked toolkits).
- Adversary-in-the-Middle (AiTM) phishing frameworks that focus on proxying and token harvesting.