Payroll Pirate - AiTM OAuth Token Theft and Session Cookie Abuse

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for suspicious browser process spawning scripting child processes (powershell.exe, wscript.exe, etc.), unusual DNS requests to Microsoft login/Graph API endpoints from scripting hosts, and direct non-browser access to browser cookie database files.