New ‘Knight Office’ Phishing Kit Steals Microsoft 365 Logins Without Touching a Password

A phishing-as-a-service kit dubbed 'Knight Office' is hijacking Microsoft 365 accounts by stealing active login sessions instead of passwords, letting attackers bypass MFA entirely. Discovered by Huntress after investigating suspicious sign-in activity, the kit uses self-spoofed DocuSign-style emails and multi-hop redirects through legitimate services like Monday.com and a compromised Joomla site to reach a fake Microsoft device-login page. Once victims complete a real login and MFA approval, their live session token is intercepted and reused from data-center infrastructure, evading password-based detection. Attackers have also been registering rogue devices and binding Windows Hello for Business credentials to compromised accounts as a persistence backdoor. Huntress linked the operator console to at least nine confirmed attacks in two weeks and over 700 similar reported emails since April, and published IOCs including a control panel IP, hosting domain, and dozens of lookalike .vu phishing domains.

Source: https://www.itsecurityguru.org/2026/09/02/new-knight-office-phishing-kit-steals-microsoft-365-logins-without-touching-a-password. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.