PhantomGate is an advanced, high-performance Adversary-in-the-Middle (AiTM) reverse proxy framework engineered in Go. Developed exclusively for authorized Red Team engagements, PhantomGate facilitates the seamless interception of complex authentication workflows. It empowers operators to capture plaintext credentials and bypass modern Multi-Factor Authentication (MFA) mechanisms across enterprise environments.
By operating as a transparent intermediary between the victim and legitimate identity providers (such as Microsoft 365, Google Workspace, or GitHub), PhantomGate seamlessly extracts high-value session cookies post-authentication. This provides security teams with a realistic, production-grade capability to simulate advanced phishing campaigns (such as those employed by APT29 and Lapsus$) and test the resilience of corporate identity boundaries.
PhantomGate operates using a highly decoupled architecture, ensuring that the proxy engine, the data storage, and the operator dashboard operate asynchronously without blocking each other. This guarantees zero latency introduced to the victim’s experience.
- Initial Hook (Lure Generation): The framework generates unique Tracking Lure URLs. When a victim clicks the link, they are routed to the PhantomGate proxy server rather than the real application.
- Dynamic Proxy Routing: The engine dynamically rewrites the requested URL and proxies the raw connection to the legitimate target (e.g.,
login.microsoftonline.com), maintaining the exact visual fidelity of the original site. - Interception & Credential Parsing: As the victim submits their username and password, the internal Capture Engine parses the HTTP POST body in real-time, extracts the credentials, and transparently forwards the request to the real server.
- MFA Bypass & Session Hijack: The real server prompts the victim for MFA. The victim approves it on their mobile device. The real server issues the authenticated session cookies. As these cookies pass back through PhantomGate, the Session Hijacker intercepts them, stores a copy in the operator database, and allows them to pass to the victim's browser.
- Operator Synchronization: Stolen credentials and cookies are synchronized to the Operator Dashboard via a secure WebSocket connection in real-time.
PhantomGate is engineered for stealth, reliability, and extreme concurrency. It addresses the shortcomings of legacy proxy tools by implementing deep protocol manipulation and memory-safe routines.
PhantomGate utilizes a dynamic, YAML-based configuration system known as Phishlets.
- Phishlets define the proxy routing rules, domain substitutions, and the specific regex patterns needed to scrape credentials and session cookies from HTTP POST bodies.
- This modular architecture allows operators to pivot between targeting different platforms in seconds without recompiling the core proxy engine.
Included Production Phishlets:
- Microsoft 365 / Azure AD (
microsoft365.yml): Targets the Microsoft authentication flow. Captures high-value tokens includingESTSAUTH,ESTSAUTHPERSISTENT, andOIDCAuthCookie. - Google Workspace (
google.yml): Intercepts Google SSO flows. Extracts crucial persistence tokens includingSID,HSID,SSID,APISID, andSAPISID. - GitHub (
github.yml): Targets developer infrastructure. Capturesuser_session,dotcom_user, and_gh_sesscookies to bypass WebAuthn and TOTP mechanisms.
To prevent automated detection by corporate proxies, Endpoint Detection and Response (EDR) agents, and secure web gateways, the engine implements active evasion techniques:
- Header Stripping: Automatically removes
Content-Security-Policy(CSP) andStrict-Transport-Security(HSTS) headers from the upstream responses, allowing modern browsers to render the proxied content without throwing security warnings. - Timing Jitter Engine: Injects micro-delays (randomized between 0-50ms) into the proxy streams. This breaks automated timing-based proxy detection signatures used by defensive appliances.
- On-the-Fly TLS Generation: Automatically generates and signs ECDSA P-256 TLS certificates entirely in memory (
internal/certgen). This leaves no static.pemfiles on disk for Blue Teams to discover during forensic incident response.
For internal network engagements, PhantomGate is equipped with a localized interception engine (internal/dns).
- ARP Poisoning & DNS Spoofing: When run with the
--interceptflag on a Linux host, the tool performs ARP poisoning against the local gateway, forcing victims on the same LAN to route their traffic through the attacker machine. It then intercepts DNS requests, redirecting corporate domains (e.g.,login.microsoftonline.com) directly into the local PhantomGate proxy.
The framework features a sophisticated Operator Dashboard that serves as the central nervous system during a live engagement.
- Access to the dashboard is strictly protected via an
X-Admin-Tokenauthentication layer across both its REST API and WebSocket streams, ensuring the infrastructure cannot be hijacked by third parties or scanned by Blue Teams. - As victims interact with the phishing portal, operators see keystrokes, submitted credentials, and session cookie captures materialize in the terminal UI in real-time.
- Operators can perform a one-click export of stolen session cookies. PhantomGate formats these cookies into standardized JSON blocks that can be directly imported into extensions like EditThisCookie, granting the operator immediate, unauthenticated access to the victim's account.
A comprehensive code and architecture audit was performed prior to handover. PhantomGate is certified as fully production-ready for enterprise engagements.
As a high-traffic proxy, the system must handle multiple concurrent victim sessions without data corruption.
- The framework utilizes Go's native goroutines and strictly adheres to thread-safe data access using
sync.RWMutex. - The codebase was analyzed using Go's advanced Race Detector (
go test -race ./...), passing with zero data races. This ensures that multiple victims authenticating simultaneously will never have their session tokens crossed or corrupted.
- Static Analysis: The
go vetstatic analysis tool reported zero shadowing errors or malformed constructs. - Test Coverage: All internal packages (Proxy, DNS Interception, Phishlet Engine, Data Store, and Lure Generation) passed their automated unit test suites (
go test). - Zero Technical Debt: The source code contains no unresolved developer notes (
TODO,FIXME,HACK), ensuring all edge cases are properly handled and documented.
PhantomGate provides a highly stable, extensible, and stealthy infrastructure for bypassing modern authentication boundaries. By weaponizing the adversary-in-the-middle methodology and pairing it with flawless concurrency handling, modular Phishlets, and active evasion engines, it is an indispensable asset for conducting realistic, high-value adversary simulations against mature target organizations.