Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

Darktrace reports a real-world AiTM attack detected during a customer trial of Darktrace / EMAIL and Darktrace / IDENTITY that compromised an Office 365 account via a business email compromise phishing email. The incident unfolded as the compromised account was used to launch internal and external phishing campaigns, with the first indicator observed being the creation of a malicious email rule, likely indicating prior compromise before Darktrace was deployed.

Internal activity escalated into a surge of outbound phishing emails to more than 9,000 external recipients within a single hour, many containing a link to an unusual Google Drive endpoint and prompts to download a PDF named “invoice.” Darktrace notes that after recipients clicked the malicious link, they were directed to a convincing landing page prompting credential entry, a flow designed to harvest credentials and enable further SaaS and email account compromise.

In its response, Darktrace’s Autonomous Response was not fully enabled across the customer’s environments, allowing progression, though it did flag the Google Drive link for potential automatic blocking if DLP actions had been enabled.

The analysis highlights AiTM as a significant evolution in credential theft, capable of bypassing MFA by hijacking session tokens and maintaining access through a reverse-proxy setup, with Darktrace emphasising that adaptive, AI-driven detection and response are essential to stop such threats in real time.