Hopper

Hopper is an adversary-in-the-middle (AiTM) phishing operation and previously undocumented phishing-as-a-service (PhaaS) kit used to proxy the real Microsoft login flow in real time in order to capture passwords, MFA responses, and session tokens. The reported investigation states that Hopper used a seven-hop redirect chain in which each stage served a distinct purpose, including tracking, anti-bot gating, session token generation, victim routing, and final proxy delivery. This redirect depth was described as an evasion technique against email gateway URL scanners that do not fully resolve redirect chains. Observed technical fingerprints included ASP.NET Core and OpenID Connect artifacts, including .AspNetCore.OpenIdConnect and .AspNetCore.Correlation cookies being set directly by the phishing domain, OIDC cookie artifacts, and “Me.htm” origin rewriting behavior. The investigation also noted a one-time token mechanism in which a tk= parameter changed on every visit. Hopper lure pages were described as containing clean, well-commented, unobfuscated JavaScript, and a unique JavaScript filename, ui-form-security.js, was used to pivot via urlscan.io and identify a multi-month campaign. Reported targeting spanned financial services, healthcare, energy, and international organisations, and lure themes rotated through SharePoint, DocuSign, Calendly, and Microsoft Defender. One lure email impersonated a French parcel delivery company and contained awkward German mistranslation, which the source characterized as consistent with PhaaS operations. The investigation states that Tycoon 2FA, Mamba 2FA, Sneaky 2FA, Gabagool, and Evilginx were ruled out as matches. No additional aliases or sub-groups were provided beyond Hopper.