PH!SH Framework
Framework / Techniques
Technique Credential Harvesting

AitM Capable Credential Harvester

Adversary-in-the-Middle (AitM) proxies live authentication sessions between the user and a real service, capturing credentials and session cookies in real time to bypass MFA protections.

Mapped to
MITRE ATT&CK®
T1557Adversary-in-the-Middle T1539Steal Web Session Cookie T1111Multi-Factor Authentication Interception T1598.003Spearphishing Link

Connected in PH!SH

Themes
TH0009Microsoft Impersonation TH0033Full Storage TH0034Expiring Password TH0035MFA TH0036Account Deletion TH0037Suspicious Login TH0038Security Update TH0039Update Information TH0041Secure Message TH0045Account Authentication TH0047Delivery Failure

Read more