Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Performing Adversary-in-the-Middle Phishing Detection · mukul975 | DecimalAI

Performing Adversary In The Middle Phishing Detection

SkillScore14Maintained

performing-adversary-in-the-middle-phishing-detection

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md

decimalai skills pull performing-adversary-in-the-middle-phishing-detection --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md https://app.decimal.ai/s/performing-adversary-in-the-middle-phishing-detection/SKILL.md

Raw file: /s/performing-adversary-in-the-middle-phishing-detection/SKILL.md ↗ · machine-readable summary at /s/performing-adversary-in-the-middle-phishing-detection.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +14% lift · at higher cost+30% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-04	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—
case-22	✗→✗	＝ Same ✗	—	—
case-21	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Performing Adversary-in-the-Middle Phishing Detection

Overview

Adversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.

When to Use

When conducting security assessments that involve performing adversary in the middle phishing detection
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Azure AD / Entra ID Conditional Access policies
SIEM with authentication log ingestion (Azure AD sign-in logs)
Web proxy with SSL inspection and URL categorization
Endpoint Detection and Response (EDR) solution
FIDO2/phishing-resistant MFA capability

Key Concepts

How AiTM Works

Victim receives phishing email with link to attacker-controlled domain
Attacker domain runs reverse proxy that mirrors legitimate login page
Victim enters credentials on proxied page; credentials captured in transit
Reverse proxy forwards credentials to real authentication service
MFA challenge sent to victim; victim completes MFA on proxied page
Attacker captures session cookie returned by legitimate service
Attacker replays session cookie to access victim's account without MFA

Major AiTM Kits (2025)

| Kit | Type | Primary Targets | Evasion | |---|---|---|---| | Tycoon 2FA | PhaaS | Microsoft 365, Google | CAPTCHA, Cloudflare turnstile | | EvilProxy | PhaaS | Microsoft 365, Google, Okta | Random URLs, IP rotation | | Evilginx | Open-source | Any web application | Custom phishlets | | Sneaky 2FA | PhaaS | Microsoft 365 | Anti-bot checks | | NakedPages | PhaaS | Multiple | Minimal infrastructure |

Detection Indicators

Authentication from unusual IP not matching user profile
Session cookie reuse from different IP/device than authentication
Login page served from non-Microsoft/non-Google infrastructure
CDN requests to legitimate auth providers from phishing domains
Impossible travel between authentication and session usage

Workflow

Step 1: Deploy Phishing-Resistant MFA

Implement FIDO2 security keys or Windows Hello for Business for high-value accounts
Configure Conditional Access to require phishing-resistant MFA for admins
Enable certificate-based authentication where possible
Disable SMS and voice MFA for privileged accounts
AiTM cannot intercept FIDO2 because authentication is bound to origin domain

Step 2: Configure Conditional Access Policies

Require compliant/managed device for sensitive application access
Block authentication from anonymous proxies and Tor exit nodes
Enforce token binding to limit session cookie replay
Configure continuous access evaluation (CAE) for real-time token revocation
Implement sign-in risk policies that require re-authentication for risky sign-ins

Step 3: Build AiTM Detection Rules

Alert on sign-in followed by session from different IP within 10 minutes
Detect authentication where proxy IP does not match user's expected location
Monitor for impossible travel patterns in session usage
Alert on inbox rules created immediately after authentication (common post-compromise)
Detect new MFA method registration from suspicious sign-in

Step 4: Monitor Web Proxy for AiTM Infrastructure

Log and analyze DNS queries to newly registered domains
Detect connections to known PhaaS infrastructure IPs
Alert on authentication page backgrounds loaded from legitimate CDNs through proxy domains
Monitor for SSL certificates issued to domains mimicking corporate login pages
Block access to known EvilProxy/Evilginx infrastructure via threat intelligence

Step 5: Implement Post-Compromise Detection

Alert on mailbox forwarding rules created after suspicious authentication
Detect OAuth app consent after AiTM sign-in
Monitor for email sending patterns indicating BEC follow-up
Alert on SharePoint/OneDrive mass download after session hijack
Track lateral movement from compromised account

Tools & Resources

Microsoft Entra ID Protection: Risk-based Conditional Access
Azure AD Sign-in Logs: Authentication event analysis
Okta ThreatInsight: AiTM proxy detection at IdP level
Sekoia TDR: AiTM campaign tracking and intelligence
Evilginx (defensive): Understanding attack mechanics for detection

Validation

Phishing-resistant MFA blocks AiTM session capture in test scenario
Conditional Access denies session replay from different device/IP
SIEM alerts fire on simulated AiTM sign-in patterns
Web proxy blocks connections to known PhaaS infrastructure
Post-compromise rules detect inbox rule creation after suspicious auth

Illustrative Want to see what performing-adversary-in-the-middle-phishing-detection would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 10:38 UTC · 22 cases

Lift

+14%

14% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+30%

3,597.91 vs 2,761.41

fail → pass · 3fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-22 Write an internal email announcement to all employees introducing mandatory Microsoft Authenticator app registration for company mobile phones, including setup steps for scanning the QR code in the security info portal.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Our IT compliance team needs to configure Entra ID Smart Lockout settings to prevent automated brute-force password spraying against user accounts. Recommend standard threshold values for lockout duration and failed login count.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Our security team is conducting an audit on our enterprise authentication defenses against reverse-proxy phishing kits. Can you outline a comprehensive guide detailing how these attacks operate, key detection indicators to log, and specific defensive configurations needed across identity providers and web proxies? Deliver this as a structured assessment document with an overview, technical phases, and validation criteria.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Create an identity access governance standard detailing how enterprise identity providers should handle requests originating from anonymizing networks like Tor or unverified proxy nodes during authentication attempts.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Threat actors who gain session access via EvilProxy often attempt to maintain persistent access without relying on the stolen cookie. What Azure AD application management event should trigger immediate SOC investigation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 We need to validate our newly deployed SIEM detection rules for AiTM session hijacking. Outline a validation test strategy that proves our Conditional Access and SIEM controls successfully detect or block session token reuse.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We are hardening privileged Entra ID administrator accounts against proxy-based MFA bypass. Draft an administrative directive outlining which legacy or weak authentication methods must be completely disabled for admins and why standard MFA fallback options fail.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Our threat intelligence team is profiling modern PhaaS frameworks to tune our edge defenses. Compare Tycoon 2FA, EvilProxy, and Evilginx in terms of their targeted platforms, primary evasion techniques, and underlying architecture. Summarize these in a structured reference guide.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 After a user enters credentials on a reverse-proxy site and completes MFA, what specific post-authentication telemetry events in Microsoft 365 indicate an attacker has taken over the account session and is preparing for business email compromise? List the primary initial actions to monitor.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 How should identity risk scores generated during an ongoing session be utilized within Entra ID to mitigate compromised sessions in progress?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During our Entra ID security review, developers suggested blocking non-US IP addresses as the main safeguard against session cookie theft from phishing sites. Write a policy design document highlighting why IP fencing alone fails and which specific Entra ID Conditional Access controls must be enabled to mitigate token replay and revoke active sessions in real time.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We manage a hybrid IdP environment running both Okta and Microsoft Entra ID. We need to deploy IdP-native risk engines specifically designed to detect adversary-in-the-middle proxy requests at the IdP edge. Recommend the specific built-in products/features for both platforms.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are upgrading our MFA enforcement in Microsoft Entra ID for executive accounts to prevent session hijacking via reverse proxies. Our team believes Push Notifications with Number Matching is sufficient to stop adversary-in-the-middle proxy kits. Please provide an authentication architecture recommendation detailing why push notifications fail and what specific credential standard stops origin domain spoofing.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Once an attacker hijacks an M365 session via Sneaky 2FA, how does the attacker typically leverage the compromised mailbox to expand the attack internally, and what specific email sending pattern should be monitored?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are configuring custom detection rules in Microsoft Sentinel for session cookie theft following phishing sign-ins. Standard travel anomalies are triggering too many false positives over 24-hour windows. Provide precise detection logic criteria focusing on immediate session reuse anomalies and post-auth infrastructure patterns.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Our threat research team encountered mentions of Sneaky 2FA and NakedPages in recent incident reports. Detail the key characteristics, primary targets, and evasion capabilities of these two PhaaS kits.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When designing a zero-trust authentication framework to resist AiTM attacks, explain why certificate-based authentication and FIDO2 security keys protect against reverse proxies while standard passwords with push notifications fail.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We are configuring SPF, DKIM, and DMARC DNS records for our corporate domain company.com to prevent domain spoofing in outgoing marketing emails. Provide a standard DMARC policy record formatted for DNS with a quarantine policy and aggregate reporting email at dmarc@company.com.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Our SOC wants to build a high-fidelity correlation rule in our SIEM to catch stealthy account persistence following an AiTM session hijack. What specific post-login credential modification event, when paired with a suspicious sign-in, indicates session compromise?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Our SOC relies on static threat intelligence IP feeds to block EvilProxy and Tycoon 2FA landing pages at the secure web gateway. Threat actors are frequently rotating IPs. What dynamic domain monitoring and certificate inspection rules should be added to our web proxy policy to catch active AiTM proxy infrastructure?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When analyzing network proxy logs during a suspected reverse-proxy phishing attack against Microsoft 365, what subtle cross-domain web request pattern specifically indicates that a proxy domain is relaying traffic to legitimate authentication infrastructure?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 After an attacker successfully captures a session cookie via EvilProxy, what cloud storage telemetry in Microsoft 365 should be audited to detect bulk intellectual property theft?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 13.6%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 2
Skill version measured: v1
Run completed: 7/28/2026, 10:38 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run14

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.