Hackers Abuse IPv6 Stateless Address For AiTM Attack Via Spellbinder Tool

A sophisticated cyber threat has emerged in recent weeks as threat actors have developed a new technique leveraging IPv6 stateless addressing to conduct Adversary-in-the-Middle (AiTM) attacks.

The attack relies on a novel tool called “Spellbinder” that manipulates IPv6 neighbor discovery protocols to intercept network traffic and harvest credentials.

This technique is particularly concerning as it bypasses many traditional security controls that focus primarily on IPv4 traffic monitoring, creating a dangerous blind spot in enterprise networks transitioning to dual-stack environments.

AiTM attacks represent an advanced form of man-in-the-middle attack where malicious actors position themselves between users and legitimate services, intercepting traffic in both directions.

This allows attackers to capture sensitive information including authentication tokens and session cookies, even when communications are secured with HTTPS.

Unlike traditional phishing, these attacks can bypass multi-factor authentication by stealing session tokens after authentication has been completed.

ESET researchers identified the Spellbinder tool in underground forums in March 2025, noting that it specifically targets enterprise environments where IPv6 has been enabled but security monitoring remains focused primarily on IPv4 traffic.

Their analysis revealed that the tool’s effectiveness stems from its ability to exploit the ICMPv6 Neighbor Discovery Protocol, which is fundamental to IPv6 network operations but often overlooked in security configurations.

The technique exploits the IPv6 stateless address autoconfiguration (SLAAC) process, a core feature of IPv6 that allows devices to generate their own IP addresses without requiring a DHCP server.

By responding to router solicitation messages and sending rogue router advertisements, Spellbinder can manipulate how victim devices route their traffic, effectively redirecting it through attacker-controlled infrastructure without alerting users or security systems.

What makes Spellbinder particularly dangerous is its selective targeting capability.

Rather than attempting to compromise all traffic, the tool can be configured to only intercept specific connections to high-value targets such as corporate email systems, cloud services, or financial platforms.

This selective approach reduces the likelihood of detection while maximizing the value of harvested credentials and authentication tokens.

Technical Implementation of Spellbinder’s Attack Mechanism

The core of Spellbinder’s effectiveness lies in its implementation of ICMPv6 spoofing.

The tool injects malicious Router Advertisement (RA) messages into local networks, causing victim machines to register the attacker’s machine as a preferred gateway for specific high-value domains.

Below is a snippet of the Python code that handles the creation of the spoofed RA packets:-

def create_router_advertisement(mac_src, ipv6_src, prefix, prefix_len, router_lifetime=9000):
    packet = Ether(src=mac_src)/IPv6(src=ipv6_src, dst="ff02::1")
    packet /= ICMPv6ND_RA(routerlifetime=router_lifetime)
    packet /= ICMPv6NDOptPrefixInfo(prefix=prefix, prefixlen=prefix_len, L=1, A=1, validlifetime=86400, preferredlifetime=14400)
    packet /= ICMPv6NDOptSrcLLAddr(lladdr=mac_src)

    return packet

When executed, Spellbinder actively monitors for DNS queries to target domains and immediately responds with crafted IPv6 addresses that route through the attacker-controlled node.

This allows the tool to selectively intercept traffic while maintaining legitimate connectivity for all other services, creating a nearly invisible attack channel.

The tool further employs TLS interception techniques using dynamically generated certificates to maintain the appearance of secure connections to victims.

Security experts recommend organizations implement strict monitoring of ICMPv6 traffic, deploy Secure Neighbor Discovery (SEND) where possible, and ensure that IPv6 security controls receive the same attention as their IPv4 counterparts.

As IPv6 adoption continues to accelerate, tools like Spellbinder highlight the urgent need for comprehensive security approaches that address both IPv4 and IPv6 protocols equally.

Are you from the SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.