8 minhigh
US Finance Under Phishing Pressure: What the SOC Data Reveals?
ANY.RUN analysis of 16K+ organizations reveals that 72.7% of finance sector investigations involve phishing, with five major phishing kits (Tycoon2FA, Sneaky2FA, EvilProxy, ClickFix, EvilTokens) accounting for the majority of threats. Attackers increasingly abuse legitimate services and employ session hijacking techniques that bypass traditional MFA. A fake Microsoft authentication page hosted on aditipoddar.org was identified as an example of adversary-in-the-middle phishing infrastructure.
Sens:7dConf:medium
IOCs4
2ip1domain1url
Detection / Hunteropenrouter
What Happened
A security company analyzed data from thousands of organizations and found that phishing attacks are a major problem for US financial companies. Over 72% of investigations at financial firms involve phishing, and attackers are using sophisticated toolkits that can bypass two-factor authentication by stealing active login sessions rather than just passwords. The FBI reports over $3 billion in losses from business email compromise in 2025 alone. Attackers disguise their attacks using trusted brands like Microsoft and Adobe, and they time their attacks around events like US tax season. Financial organizations should evaluate their email security, train employees to recognize phishing, and consider tools that provide behavioral analysis of suspicious emails rather than relying solely on traditional detection methods.
Key Takeaways
- 72.7% of finance sector investigations involve phishing, with 14.8% of submitted emails being malicious.
- Top phishing kits targeting US finance are Tycoon2FA (18.7%), Sneaky2FA (17.1%), EvilProxy (13.5%), ClickFix (11.8%), and EvilTokens (10.5%).
- Session compromise is replacing credential compromise as the primary phishing threat, allowing attackers to hijack already-authenticated sessions and bypass MFA.
- FBI recorded 191,561 phishing complaints in 2025 with BEC losses exceeding $3 billion; global BEC losses exceed $55 billion since 2013.
- Attackers abuse legitimate services including Microsoft 365, Adobe, and cloud infrastructure to blend malicious activity into normal business traffic.
Affected Systems
- Microsoft 365 environments
- Corporate email systems
- Browser-based authentication workflows
- US financial sector organizations
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing emails targeting US finance employees using tax-season lures, fake IRS communications, and time-sensitive financial documents
- Execution: Victim clicks link redirecting to adversary-in-the-middle phishing page (e.g., aditipoddar.org) mimicking Microsoft 365 authentication
- Credential/Session Harvest: Phishing kits such as Tycoon2FA or Sneaky2FA capture credentials and session tokens, bypassing MFA via real-time relay
- Persistence: Attacker uses stolen session tokens to maintain authenticated access without requiring re-authentication
- Defense Evasion: Malicious activity blends with legitimate traffic by abusing Microsoft 365, Adobe, cloud infrastructure, and document-sharing services
- Impact: Business email compromise, financial fraud, and data exfiltration with reported losses exceeding $3 billion in 2025
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: ANY.RUN TI Lookup
The article references a TI Lookup query (submissionCountry:"US" AND industry:"finance") for browsing US-submitted malware samples across financial organizations. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The article focuses on phishing and session hijacking via browser-based adversary-in-the-middle attacks. EDR has limited visibility into browser session token theft since the authentication appears to come from a legitimate user session. |
| Network Visibility | Medium | Network monitoring could detect connections to phishing domains like aditipoddar.org. However, attackers abuse legitimate services and CDN infrastructure, making network-level distinction between malicious and benign traffic difficult. |
| Detection Difficulty | Hard | Session token theft bypasses MFA and credential-based detection. Phishing pages mimic legitimate Microsoft authentication. Attackers abuse legitimate services for hosting and delivery. Distinguishing malicious sessions from valid user sessions requires behavioral analytics and session context. |
Required Log Sources
- Email gateway logs
- Web proxy logs
- DNS resolution logs
- Microsoft 365 audit logs
- Identity provider authentication logs
- Conditional access policy logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for authentication events where the session was established from an IP address or user-agent inconsistent with the user's typical access patterns, indicating possible session token replay (T1185). | Identity provider authentication logs, conditional access logs, Microsoft 365 sign-in logs | Initial Access / Persistence | Medium — legitimate users may access from new devices, VPNs, or travel locations. |
| Consider hunting for DNS queries to domains hosting fake Microsoft authentication pages, particularly domains with Microsoft auth configuration that are not registered to Microsoft. | DNS logs, web proxy logs, EDR DNS query events | Initial Access | Low — non-Microsoft domains serving MS auth configurations are unusual in normal business traffic. |
| Consider hunting for email messages containing links to domains with recently registered certificates or hosted on CDN infrastructure with obfuscated JavaScript, consistent with adversary-in-the-middle phishing kits. | Email gateway logs, URL sandboxing results, TLS certificate transparency logs | Initial Access | Medium — legitimate marketing and SaaS platforms also use CDNs and JavaScript. |
| Consider hunting for internal spearphishing patterns where compromised finance accounts send emails with malicious links or attachments to other internal users. | Email gateway logs, Microsoft 365 mail flow logs, EDR process logs for email client activity | Lateral Movement | Medium — internal emails with links are common in normal business workflows. |
Control Gaps
- Traditional MFA does not prevent session token theft via adversary-in-the-middle phishing kits.
- Email gateway URL filtering may not block phishing pages hosted on legitimate CDN infrastructure or newly registered domains.
- Signature-based detection cannot identify session hijacking since the attacker uses a valid authenticated session.
- Network-level detection struggles to distinguish between legitimate Microsoft 365 authentication traffic and phishing relay traffic.
Key Behavioral Indicators
- Authentication events from IP addresses geographically inconsistent with user baseline
- User-agent strings inconsistent with the user's typical browser or device profile
- DNS queries to non-Microsoft domains serving Microsoft authentication page content
- Email messages containing links to domains registered outside Microsoft's infrastructure but presenting MS auth configurations
- Rapid succession of authentication events from different geographic locations (impossible travel)
- Session tokens used from infrastructure not associated with the user's known device fingerprint
False Positive Assessment
Medium — The phishing domains and IPs are specific indicators with low false positive risk. However, behavioral detections for session hijacking and impossible travel may generate false positives from legitimate user travel, VPN usage, or new device enrollment.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the domain aditipoddar.org and associated IPs (104.21.23.95, 172.67.210.40) at your email gateway, web proxy, and DNS filtering layers.
- Consider reviewing recent authentication logs for connections to aditipoddar.org or related phishing infrastructure to identify potentially compromised sessions.
- If applicable, evaluate whether conditional access policies can enforce session token revocation for users who accessed known phishing infrastructure.
Infrastructure Hardening
- Consider implementing phishing-resistant authentication methods such as FIDO2 hardware tokens that are not susceptible to adversary-in-the-middle relay attacks.
- Evaluate whether your identity provider supports session token binding to device fingerprints or specific network contexts to limit token replay.
- Consider deploying email authentication enforcement (DMARC reject policy) to reduce spoofed domain usage in BEC attacks.
- If supported by your email gateway, evaluate enabling URL rewriting and time-of-click URL scanning to catch phishing links that pass initial inspection.
User Protection
- Consider deploying browser-based isolation for users accessing external links from email messages to prevent direct credential exposure to phishing pages.
- Evaluate whether your endpoint protection can alert on browser activity involving non-Microsoft domains presenting Microsoft authentication interfaces.
- Consider implementing session timeout policies for financial applications to reduce the window of opportunity for session token abuse.
Security Awareness
- Consider incorporating tax-season-specific phishing awareness into existing training programs, as attackers time lures to US financial events.
- Consider training employees to verify sender domains for Microsoft 365 authentication prompts and to recognize that legitimate Microsoft login pages are hosted on microsoft.com.
- If applicable, consider rolling simulated phishing exercises using adversary-in-the-middle techniques to measure detection and reporting rates.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Lateral Movement
Tactic
Collection
Showing defanged values
- domainaditipoddar[.]orgDomain hosting a fake Microsoft authentication page. Detected as adversary-in-the-middle phishing infrastructure with obfuscated JavaScript and MS auth configuration on a non-Microsoft site.
- ip104[.]21[.]23[.]95IP address resolving to the aditipoddar.org phishing domain hosting fake Microsoft authentication pages.
- ip172[.]67[.]210[.]40IP address resolving to the aditipoddar.org phishing domain hosting fake Microsoft authentication pages.
- urlhxxps://aditipoddar[.]org/common?key=qzocx54zbPhishing URL serving a fake Microsoft authentication page designed to harvest credentials and session tokens from finance sector targets.
