A passed identity check no longer proves the right person is in control
What the report found
The finding that should most concern fraud and risk teams is the one the report calls a KYC interception cloak, run by a financially motivated group tracked as GTG-50020, an actor with a history of intrusions against hotel booking and financial technology platforms, the exact sector adjacency many of our own customers sit in. In one earlier intrusion the same group exfiltrated roughly 26 gigabytes of data and sought between $1.5 and $2.5 million to keep it off dark-web forums.
The cloak works like this. Victims were directed to lookalike identity-verification domains. These were not the crude fakes that grab a photo of a passport and disappear. Each one was a reverse proxy sitting in the middle of the real know-your-customer flow. The victim, believing they were verifying with a legitimate service, completed a genuine identity check: real document, real selfie, real liveness step. The proxy relayed every part of it to the real provider and, from its position in the middle of the connection, captured the verified session and the submitted documents. The attacker then replayed that verified session from their own machine and walked into the account.
Why it matters for your business
Identity verification is the control most businesses lean on hardest, because it is supposed to establish, once, that the person on the other end is who they claim to be. Everything downstream, transaction limits, trust scoring, regulatory attestations, inherits that single judgment. This attack does not forge the moment of verification. It lets it happen correctly and steals the result, which means the flaw is passed down to every control built on top of it. A "verified" flag in your system stops being a guarantee that the verified person is the one now operating the account.
The costs are not abstract. A verified account in the wrong hands is the starting point for money laundering, fraudulent transfers, and chargebacks, and it puts you in the uncomfortable position of having satisfied your KYC obligations on paper while a criminal operates inside the perimeter those obligations were meant to protect. The audit says you did everything right. The outcome says otherwise.
The other half: fraudulent accounts built at industrial scale
The same group ran the inverse problem too, a fraud account factory. Residential proxies and antidetect browser profiles made each fake signup look like a distinct, ordinary person from a plausible location. Bots drove the signup flows against exchange and marketplace targets. Commercial CAPTCHA-solving services and automated inbox polling cleared the human-verification gates, automated steps handled the identity checks, and the resulting verified accounts were banked for later use. If your defense against fake accounts rests on a CAPTCHA, an email confirmation, and a device fingerprint, this is a group that has industrialized defeating all three, and rents the tooling to anyone who wants it.
Where it can be stopped
There are two honest answers here, and they sit on opposite sides of the browser.
For your people and your customers, the goal is that they never reach the lookalike verification page in a state where they will act on it. That is what Haven for Business does. It is a browser extension that checks whether a page truly is who it claims to be, rather than trusting how convincing it looks or how the user arrived. When someone is routed to a lookalike verification or login domain, Haven flags it as impersonated before they enter anything. It does not rely on the domain's reputation or on the user noticing a single swapped character, which is exactly what these lookalikes are engineered to defeat.
For the flow you operate, the deeper answer is to make a verified session worthless to a proxy in the middle. That is what MirrorTab, our enterprise product, is built for. MirrorTab renders your web app and its sensitive workflows so that the page's code, the DOM, the tokens, and the session never actually live in the end user's browser. There is no session sitting in a browser for a man-in-the-middle relay to lift, and no document or token exposed on the endpoint to capture and replay. If you run the KYC or account flow attackers are trying to relay, this is the line between a stolen session being useful and being inert. Haven for Business is the customer's shield; MirrorTab is the operator's.
Your brand is now a delivery vehicle for attacks on your own customers and staff
What the report found
The report is full of infrastructure that exists only to wear someone else's identity. A state-linked group stood up a family of fake Microsoft sign-in domains, including ms365-live[.]com, teams.ms365-live[.]com, and m365-owa[.]com, to run device-code phishing that abused Microsoft's own legitimate sign-in flow. Separately, a financially motivated operator registered a domain impersonating the French national police, policenationale[.]cc, though in that case the report assesses it was branding for a stolen-card marketplace rather than a phishing lure. What carries across both is how little effort the impersonation now takes to stand up and re-stand up.
Why it matters for your business
The espionage motive behind some of this infrastructure is not the threat model most businesses face, and we will not pretend otherwise. But the technique is everyone's problem, because the report's central observation applies squarely here: building convincing impersonation infrastructure used to take real effort, and now it does not. When a lookalike domain, a pixel-matched login page, and a working phishing flow can be generated and regenerated on demand, brand impersonation stops being an occasional incident you respond to and becomes an ambient condition you operate inside.
That has two edges for a business. Your employees will be shown convincing fakes of the tools they sign into every day, which is how corporate credentials and live sessions get taken. And your customers will be shown convincing fakes of you, which drops your brand into the middle of fraud you did not commit and cannot easily see, and leaves you holding the support load, the chargebacks, and the trust damage afterward.
Why training people to spot it is not enough
Device-code phishing and similar techniques abuse legitimate sign-in flows, which means the fake page can be pixel-perfect and the sign-in itself entirely genuine. There is often nothing visually wrong to notice, so "look for something off" is not a defense you can reasonably ask a busy employee or customer to carry. We wrote about why the old warning signs have stopped working in Please stop telling people to look for spelling mistakes.
Where it can be stopped
This is a place to be precise about scope. Haven for Business flags the impersonated page at the moment your employee or customer is about to act on it, which is the point where the chain can still be broken. It does not take the attacker's domain down, and it is not an email gateway. It is the layer that catches the lie in the browser after everything upstream, the email filter, the domain reputation, the visual design, has been engineered
Spinning up a convincing fake of your brand now costs almost nothing
What the report found
Two cases should change how you think about your own web properties, because in both the attack runs client-side, inside the browser of someone who trusts your site, with nothing downloaded and nothing for endpoint antivirus to catch.
In the first, a hacktivist operator compromised a media outlet and injected a browser-exploitation framework directly into the site's reader-facing script. Every visitor's browser was fingerprinted as it loaded the page, and the operator went hunting specifically for the editorial staff's sessions and credentials. The readers did nothing wrong. They opened a page on a site they trusted, and the compromised page reached into their browsers.
In the second, against a different target, the operator planted a WordPress "must-use" plugin, a type that runs on every page load and cannot be switched off from the admin dashboard, that silently harvested submitted credentials, encrypted them with per-site keys, and staged them for pickup. The same actor also poisoned the victim's backups, so that restoring from a supposedly clean backup would simply reinfect the site. It is the same shape as a malicious browser extension: an invisible, persistent skimmer sitting between the user and the form they are filling in. We have written about that pattern from the extension angle in malicious browser extensions steal sessions, and MFA does not stop it.
Why it matters for your business
Most of your defenses assume the attack arrives from outside: a bad email, a malicious download, a phishing link. These cases invert that. If your site, or any third-party script, plugin, or component running inside it, is compromised, your own property becomes the delivery mechanism. The attack executes in your visitors' and your staff's browsers, the sessions it steals sail straight past MFA because the user already authenticated, and none of it necessarily touches the server logs or the endpoint tools you are watching. For any business whose product, storefront, or portal is a web app, this is your customers' sessions and your own employees' access being taken through the front door you built and maintain.
Where it can be stopped
This is the case MirrorTab was built around. When your application is rendered so that the DOM, the scripts, the form data, and the session never touch the end browser, an injected script, a malicious extension, or a man-in-the-browser has nothing to read and nothing to modify. The form submission cannot be skimmed, the receipt cannot be quietly altered, and the session cannot be lifted, because none of it is exposed where the attacker is standing. As we argued in the browser is the new OS, secure it like one, the browser is now the operating system your business runs on, and it needs to be defended like one rather than trusted by default.
Account takeover no longer requires your password or your MFA
What the report found
A theme runs across the whole report: the target is increasingly the session, not the credential. One group took over victims' WhatsApp accounts by linking attacker-controlled devices as companion devices through headless-browser automation, quietly suppressing read receipts so the victim never noticed while their conversations were bulk-exported. Another ran device-code phishing to steal Microsoft 365 tokens directly. A third, after breaching a single SaaS provider, dumped more than 2,100 Azure AD token sets spanning more than 40 corporate tenants in about thirty-four hours, and in a separate compromise escalated from one stolen developer token to full administrative control of a cloud environment in roughly three hours.
Why it matters for your business
Once an attacker holds a live session or token, your login-time defenses are already behind them. They did not defeat your password, and they did not need to defeat your MFA, because they are holding the proof that both already happened. This is the shift that quietly dates so much MFA-based security advice, and we have covered it from the phishing side in the attack that bypasses your password and MFA and a phishing service that beat MFA at 258 companies.
The SaaS token dump is the part that should worry even businesses with their own house in order. You can run clean identity hygiene and still inherit a breach, because a vendor holding sessions into your tenant becomes your exposure the moment that vendor is compromised. Session theft turns one supplier's bad week into forty companies' incident, and it happens at machine speed: the report describes that cross-tenant dump completing in about a day and a half.
Where it can be stopped
For your people, Haven for Business flags the fake device-code and sign-in pages that begin these chains, before a token is ever handed over. For your own app, MirrorTab lowers the payoff at the other end, because a session that never lives in a reachable browser is far harder to steal and replay. Neither one fixes the SaaS supply chain on its own, and we will not pretend a browser layer does. But both go after the same economic assumption the report keeps returning to: they make the session less stealable and the impersonated page less effective, which raises the attacker's cost per victim in exactly the market where cost is now the whole game.
What ties these cases together
The report closes its case studies with a section on prevailing trends, and it lands on the point that makes all of the above matter for businesses of every size. The techniques are familiar, it says, but the economics of them have changed. The reconnaissance, the exploitation, the tool-building, and the sorting of stolen data, the labor that used to separate a well-resourced crew from an amateur, is now delegated to AI running in parallel at machine speed. The report describes breaches completed in two to three hours and single operators handling dozens of victims at once.
That is a conclusion about you more than about the attackers. The capabilities it describes are no longer rationed by skill or budget. The report is blunt that the distinguishing feature between a lone criminal and a state-sponsored team is no longer sophistication but intent, because AI has handed both the same toolkit. When that is true, the question stops being "are we a big enough target for someone capable?" and becomes "are we reachable, and is there anything worth taking once someone arrives?" For almost every business, the honest answers are yes and yes.
That does not call for panic, and it does not call for a new acronym. It calls for defending the surface where all of this actually happens. Attackers have converged on the browser because that is where your people make trust decisions and where your customers' sessions live. Defending it has two halves, and they are genuinely different jobs. Protecting your people as they browse, so they do not hand credentials or approvals to a page impersonating you, is Haven for Business, a browser extension that catches the impersonated page in the moment. Protecting the sessions running on your own web app, so a compromised device, a malicious extension, or a proxy in the middle cannot read or replay them, is MirrorTab, our enterprise product that removes the browser as an attack surface for your application.
The economics have moved against defenders who are still counting on attacks being expensive. The response is not to make your people better at spotting fakes that were built to be unspottable, or to hope your web app is never the one that gets injected. It is to make the two things attackers are now industrializing, the impersonated page and the stealable session, stop paying off.
About Haven and MirrorTab
Haven is a browser extension that helps people make safer trust decisions online, before a scam can cost anything. It works at the moment someone is about to click a link or enter a password, flagging fake and impersonated login pages, suspicious links, and look-alike sites, and pausing risky downloads. Haven is free for individual use, and Haven for Business extends that protection across every employee's browser.
MirrorTab is our enterprise product for protecting the sessions running on your own web apps and APIs. It renders your application so that its code, DOM, tokens, and session never live in the end user's browser, which removes the browser as an attack surface for man-in-the-browser attacks, malicious extensions, formjacking, session theft, and automated fraud, with no user installs. Haven and MirrorTab are built by MirrorTab, Inc.
