An analyst traced one phishing email to dozens of lookalike domains impersonating manufacturers, staffing agencies, and waste haulers.

 

What happened

Yanky Wilson, a cybersecurity analyst who runs incident response for a managed service provider, described tracing a single reported phishing email back to the server behind it, in a column for CSO Online published October 8, 2026. The email had come from a genuinely compromised mailbox at a real company. Every authentication check passed. The phishing site sat behind a content delivery network, which hides the address of the server actually hosting it. Wilson says ten standard investigative approaches failed before one worked. That server led him to a larger operation built over six months to support invoice fraud against the customers of the companies it impersonated.

 

Going deeper

The phishing kit was a relay. It sits between the victim and Microsoft's real sign-in service, passes traffic both ways, and keeps a copy of the password and the session token. The victim sees a real page and completes a real multifactor prompt. Wilson's break came from a cookie. When the relay connected to Microsoft, Microsoft set a cookie recording the address the connection came from. That address was the relay's, not the victim's. The relay passed the cookie back to the victim's browser unchanged, so the victim was handed the attacker's server address. From there Wilson found a second domain pointing at the same server, then a registrar used nowhere else, then a handful of machines hosting dozens of lookalike domains.

 

What was said

"The domain is the cheapest thing the adversary owns," Wilson wrote. He timed an attacker going from registering a domain to serving a live credential-harvesting page in under 24 minutes. His argument is that blocking domains costs attackers almost nothing to work around, while servers take money and setup time and are reused across campaigns. He has published the indicators and detection rules from the case in a public repository so others can test his findings.

 

In the know

Relay kits have been studied for years, and the research points to the same layer Wilson describes. Researchers at Stony Brook University tracked 1,220 relay phishing sites over a year, in a peer-reviewed study presented at the ACM Conference on Computer and Communications Security. They found the relay design weakens detection methods that look at page content, since the content is Microsoft's own. Their approach looked at network behaviour instead, including timing and the technical fingerprint of how a connection is made. Microsoft documented a single relay campaign that reached more than 10,000 organizations in its 2022 analysis. It used the stolen sessions to run business email compromise, the same end goal Wilson found.

 

The big picture

The detail that let Wilson find the server also gives defenders something to look for in their own logs. When a staff member is phished through a relay, the successful sign-in in the organization's Microsoft 365 records shows the relay's address, not the employee's. Addresses belonging to hosting providers and rented virtual servers stand out, because staff have no reason to sign in from them. The attacker's later activity shows up as token refreshes rather than new sign-ins, so a search limited to interactive logins misses it. Response order matters too. Microsoft's guidance for a compromised account is to revoke the user's sessions and refresh tokens, according to its Entra documentation. Access tokens already issued last an hour by default. A password reset alone leaves a stolen session working. The suppliers in Wilson's case, staffing agencies and waste haulers, are vendors hospitals pay against emailed invoices.

 

FAQs

What is a relay phishing kit?

Software that sits between a victim and a real sign-in page, passing traffic back and forth while copying what goes through. The victim signs in to the genuine service, so the page looks and behaves normally.

 

Why does multifactor authentication not stop it?

The victim approves the prompt on the real service through the relay. The relay keeps the resulting session token, which lets the attacker use the account without needing the password or prompt again.

 

What does removing sessions do?

It invalidates the refresh tokens and forces the user to sign in again everywhere. Without it, a stolen session can keep working after the password has been changed.

 

Why look at token refreshes rather than sign-ins?

After the initial theft, the attacker stays in by refreshing the stolen token rather than signing in again. A search that only covers interactive sign-ins sees the moment of compromise and misses what followed.

 

Should organizations stop blocking phishing domains?

No, blocking still stops known bad sites. Wilson's point is that it can't keep pace on its own, because new domains are cheap, so detection based on servers and sign-in behaviour needs to sit alongside it.