In the wild
Realized harm
Attackers hosted phishing redirectors on the AI presentation tool Gamma to front an adversary-in-the-middle SharePoint credential portal
AIR-2025-0023 AIR record · 2025-04-gamma-ai-phishing-redirector
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
By hosting the initial redirector on Gamma's domain, attackers exploit the trust associated with the platform, making it harder for security vendors to identify and block these threats.techradar.com
The record
Disclosed
2025-04-15
Occurred
2025-04
Vendor
Gamma (abused); Microsoft 365 accounts (targeted)
Product
Gamma
Risk domain
Access control and permissions › Credential theft
Also touches
Sensitive data exposure
System type
Generative model
Who acted
Agent acted (contested) — the AI tool generated and hosted the live redirector page
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Legitimate service abuse
Impact type
Credential theft, Information disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
organisations whose employees received the lures; AiTM captured live session cookies, defeating MFA
Capability abused
Defense & remediation
Recorded defense
email security filtering; MFA on the target accounts
Guardrail kinds
Authentication
Guardrail outcome
Silent
Fix shipped
undisclosed
Taxonomy & references
Curator notes
Disclosed by Abnormal Security. The AI platform is infrastructure, not payload: gamma.app is commonly whitelisted, so the lure passes filters, and Gamma's import-from-URL cloning builds the impersonation. Abnormal's point is that employees have no familiarity baseline for newer AI SaaS, so nothing looks wrong. MFA did not help — the AiTM stage validated credentials and captured session cookies in real time. AI Incident Database incident 1068.
Supporting sources
Cite as
Enkrypt AI. "Attackers hosted phishing redirectors on the AI presentation tool Gamma to front an adversary-in-the-middle SharePoint credential portal". AIR, AIR-2025-0023. https://agentincident.vercel.app/i/AIR-2025-0023/ (accessed 2026-10-19).