Green Proxy: a first look at an undocumented AiTM phishing-as-a-service platform
TL;DR. While responding to a phishing incident at a Chilean company in November 2026, we found a Microsoft 365 adversary-in-the-middle (AiTM) kit that matches no publicly documented family. Its CAPTCHA domain is also the customer panel of a phishing-as-a-service platform called "Green Proxy". The panel requires license keys in the format GPKEY-XXXX-XXXX-XXXX. The platform has been online since at least September 2025. In May 2026, the IP address that now runs its sign-in proxy was distributing Mirai binaries (the block changed hosting provider in between). All indicators, YARA rules and STIX bundles are published at github.com/aacunaa/scgx02-iocs.
Delivery: a two-step "request for quotation"
The lure is built to defeat email filters in two steps:
- First contact. A short "Quotation" / "Request for Quotation" email arrives from a *real, compromised* mailbox. It has no link and no attachment, so there is nothing for a filter to analyze. Four Japanese business mailboxes on the same shared host were used between 30 Oct and 1 Nov 2026.
- Follow-up. If the recipient answers, a "Re: Quotation" arrives from a *different* sender. It comes from a lookalike domain that impersonates a real company and signs with its own DKIM, so SPF, DKIM and DMARC alignment pass. The link starts on a legitimate organization's
/oauth/authorizeendpoint. Called withprompt=none&id_token_hint=dummy, that endpoint redirects to the attacker'sredirect_urieven though it returns an error. The URL first lands on a compromised small-business site, whose page only forwards the browser to the gate.
The only visible signal was human: the sender changed in the middle of the conversation. The recipient noticed it and reported the email.
The gate
The gate (a4vhglh3m.yizhaojingyun[.]com in this campaign) decides who sees the phishing page. Bots end up on stackoverflow.com or google.com. It uses four controls:
| Control | What it does |
|---|---|
POST /.verify | A SHA-256 proof of work plus a bot score. The JSON body carries challenge_id, solution, sig_score, sig_flags, fp, tz, tz_off, hc and dm. Signals such as webdriver, HeadlessChrome and software WebGL renderers (swiftshader, llvmpipe) add points. On success the gate sets a _vfy cookie valid for 7 days on the base domain |
POST /.detect | A sandbox detector: {"type":"sandbox","score",…,"ent_count":0} |
POST /.devtools | A developer-tools trap. It reports keyboard shortcuts and window-resize heuristics, then hides the page. The kit also injects it into every Microsoft page it proxies |
| Own CAPTCHA | Runs on a separate domain and port: greenproxysimpleserver[.]cc:8443/captcha/api returns {cid, nonce, difficulty, timestamp} and is verified by /captcha/verify. hCaptcha is wired in but switched off (USE_HCAPTCHA = false, sitekey 24600978-7df2-44bc-9a8c-a18c95ca6886) |
Behind the gate, one-time /p/<token> hops lead to a real-time proxy of the Microsoft sign-in page on tfgevds., loginlive. and loginms.yizhaojingyun[.]com. Like other AiTM kits, it captures the session even when MFA is not phishing-resistant.
The gate's JavaScript is not obfuscated. Its comments are numbered with emoji ("2️⃣ Solve PoW (MUST match server)"), which is unusual for commercial kits.
Not a known family
| Family | Overlap with Green Proxy |
|---|---|
| Sneaky 2FA (Sekoia) | None of its markers appear: no "food" filler text, no email_from_url, no vrs=, no /[a-zA-Z0-9]{150}/verify paths |
| Mamba 2FA, Tycoon2FA | No markers found |
| "Shield" fork of Sneaky 2FA (OSINT Team, May 2026) | The closest. It also serves a PoW CAPTCHA configured through an API (cid, nonce, difficulty). The implementation, paths, UI and redirects are different |
Our working hypothesis is a new kit that reuses ideas circulating in the ecosystem. Comparing its proxy component with known kits is still in progress.
The storefront
The root of greenproxysimpleserver[.]cc is a login page titled "Green Proxy — Login". It asks for a username or email, a password and a license key `GPKEY-XXXX-XXXX-XXXX` ("Required for All Users"), and it offers "Create Account". The HTML has been identical in public urlscan.io scans from April to November 2026, with SHA-256 50448224e0cb3dbcee198157ad6e01f3c59b36b7fb7e43601aa9f94ed842fb6a.
Pivoting on the panel's logo (SHA-256 d1fc8bf9fbb5a0efaef075466ddb2531e07a7a6405e31d2155538c03af77f688) led to an earlier panel titled "GreenProxy — Login" on eargentyna[.]com. That domain had 23 subdomains issued between September and November 2025, several of which look like country codes (pak., indo., bra., fra.).
We never logged in to any panel.
Infrastructure and a Mirai link
| Date | Event |
|---|---|
| Jul 2025 | The logo file is named after a screenshot taken on 2025-07-12 |
| Sep–Nov 2025 | greenproxysimpleserver[.]cc is registered (NameSilo); eargentyna[.]com subdomains appear |
| Apr 2026 → | The "Green Proxy — Login" panel is seen on urlscan.io |
| 6 May 2026 | 94.26.106.29, then announced by dataforest GmbH (AS215607), serves Mirai binaries from /bins/ (URLhaus, reported by c2hunter; MalwareBazaar tag wraith) and presents a self-signed certificate for cnc.murrezbots[.]vip |
| 24 Aug 2026 | yizhaojingyun[.]com, a re-registered aged domain (NiceNIC), points to the same IP; more than 100 random 10-character subdomains follow within two weeks |
| Nov 2026 | Both yizhaojingyun[.]com and murrezbots[.]vip still resolve to 94.26.106.29 |
Since 31 May 2026 the 94.26.106.0/24 block is announced by TechTies (AS197170), where all the platform's current origin servers sit; before that, and during the Mirai activity, it was announced by dataforest GmbH (AS215607). The domains are recycled (aged) registrations through NiceNIC and NameSilo. Whether the botnet and the phishing platform share an operator is possible but not proven: the block changed upstream provider at the end of May 2026, so the IP may have changed hands between the two activities. Only the providers can tell.
Detection ideas
- Email. Look for
/oauth/authorizelinks carryingprompt=noneorid_token_hint=whoseredirect_uripoints to a different domain. - Email. Look for a "Re:" with links from a domain that had no history with the organization, different from the sender of the link-free first message the user answered. In one tenant over 30 days this returned 4 hits, including the attack.
- Proxy logs. Look for
POSTrequests to/.verify,/.detector/.devtools, or for requests to:8443/captcha/(api|verify). - Hunting. Search urlscan.io for
hash:50448224e0cb3dbcee198157ad6e01f3c59b36b7fb7e43601aa9f94ed842fb6aorhash:d1fc8bf9fbb5a0efaef075466ddb2531e07a7a6405e31d2155538c03af77f688to find new panels. - Defense. Phishing-resistant MFA (FIDO2 or passkeys) defeats the relay.
YARA rules for the gate are in the repository (yara/rfq-aitm.yar). The KQL queries are available on request.
Indicators (defanged)
greenproxysimpleserver[.]cc · eargentyna[.]com · yizhaojingyun[.]com · ipfs-us[.]com · cnc.murrezbots[.]vip · 94.26.106[.]29 · 91.92.47[.]181 · 45.153.34[.]192. The full list, STIX 2.1 bundles and feeds are at github.com/aacunaa/scgx02-iocs. The C2 domains are also in ThreatFox.
MITRE ATT&CK: T1566.002, T1586.002, T1656, T1557, T1539, T1497, T1583.001.
Collected passively (urlscan.io, certificate transparency, DNS, RDAP, abuse.ch), plus a single walk-through of the incident link in a controlled browser. Victims are anonymized. Questions and corrections: adolfo@raiku.cl.