Researchers expose "Green Proxy" Microsoft 365 phishing kit using greenproxysimpleserver.cc and yizhaojingyun.com
Raiku Solutions details a Microsoft 365 adversary-in-the-middle phishing kit it calls Green Proxy, sold as a service via greenproxysimpleserver.cc and using yizhaojingyun.com. Phishing-resistant MFA such as passkeys defeats it.
- First reported
- Reports
- 1
Source: raiku.cl · published
What happened
On 4 November 2026 Raiku Solutions published research describing a Microsoft 365 adversary-in-the-middle (AiTM) phishing kit it calls Green Proxy, which it found while responding to a phishing incident at a Chilean company in November 2026. The researchers say the kit is sold as a phishing-as-a-service platform whose customer panel sits at greenproxysimpleserver.cc and requires license keys in the format GPKEY-XXXX-XXXX-XXXX. They say the platform has been online since at least September 2025 and that the attack infrastructure also uses the domain yizhaojingyun.com.
How the scam works
According to the report, the lure is a link-free Quotation email sent from a compromised mailbox, followed by a Re: Quotation message from a DKIM-signed lookalike domain. The chain then runs through a gate at a4vhglh3m.yizhaojingyun.com, which sends automated bots to stackoverflow.com, and a CAPTCHA step at greenproxysimpleserver.cc:8443 that requires a proof-of-work calculation. A victim who passes is handed to a proxy on loginlive and loginms subdomains of yizhaojingyun.com, which sits between the user and the real Microsoft 365 login and captures the session, including the result of multi-factor authentication, unless that MFA is phishing-resistant.
The researchers say the root of greenproxysimpleserver.cc is a Green Proxy login panel, and that pivoting on its logo led to an earlier panel on eargentyna.com. They report the infrastructure is hosted on TechTies (AS197170), having previously used dataforest (AS215607), and that in May 2026 the IP now running the sign-in proxy was serving Mirai malware binaries, possibly under a different operator at the time. Their key defensive point is that phishing-resistant MFA such as FIDO2 security keys or passkeys defeats this relay, because the stolen session cannot be replayed. They give the contact raiku.solutions@raiku.cl. These are the researchers' findings; scammers.com has summarised them and not independently verified them.
Source
Raiku Solutions research, Green Proxy Microsoft 365 AiTM phishing kit, 4 November 2026. Not independently verified by scammers.com.
Red flags
- A Quotation or Re: Quotation email from a compromised or lookalike sender.
- A CAPTCHA or verification step before a Microsoft 365 login page.
- A login page on a domain that is not login.microsoftonline.com.
- A sign-in that still fails or behaves oddly after you approve an MFA prompt.
- Multi-factor approval requests you did not initiate.
If you were targeted
- 1Use phishing-resistant MFA such as FIDO2 security keys or passkeys for Microsoft 365.
- 2Check the address bar before entering Microsoft 365 credentials; only use login.microsoftonline.com.
- 3Treat unexpected Quotation emails and verification steps with suspicion.
- 4If you entered credentials, reset the password and revoke active sessions at once.
- 5Have IT review sign-in logs for logins from unexpected locations.