AiTM proxy injects fake voicemail authorize redirect with non-Microsoft origin and rewritten oauth2 authorize path

Duo Tech@duotech

•updated Aug 10, 2026•1•0•4

Detects AiTM reverse-proxy pages injecting the ServerData=$Config script alongside a redirUrl/api.country.is capture script and a rewritten login.microsoftonline.com authorize path hosted on a non-Microsoft domain, used to steal OAuth2 session tokens and bypass MFA.