A new and highly advanced cyber threat has emerged recently, where attackers are using a unique method that exploits IPv6 stateless addressing to execute Adversary-in-the-Middle (AiTM) attacks.
At the heart of this threat is an innovative tool called “Spellbinder,” which manipulates the IPv6 Neighbor Discovery Protocol to hijack network traffic and extract sensitive data like credentials.
What makes this attack especially alarming is that it evades many conventional security measures, which are typically designed to monitor only IPv4 traffic. This creates a critical vulnerability, particularly in enterprises that are adopting dual-stack environments, where both IPv4 and IPv6 are used simultaneously.
AiTM attacks are a sophisticated form of man-in-the-middle tactics, where attackers position themselves between users and legitimate services to intercept and manipulate communication. This allows them to capture sensitive data such as authentication tokens and session cookies, even when the connection is protected by HTTPS encryption.
What sets AiTM attacks apart from traditional phishing is their ability to circumvent multi-factor authentication by stealing session tokens after users have already authenticated.
The Spellbinder tool was first identified by ESET researchers in March 2025, who discovered it on underground forums. It appears to be specifically designed for environments where IPv6 is enabled, but security measures still focus primarily on IPv4 traffic monitoring.
Their investigation revealed that Spellbinder is able to exploit the ICMPv6 Neighbor Discovery Protocol, a vital part of IPv6 networking that is often overlooked when configuring security defenses, giving the attackers a powerful and stealthy advantage.
Spellbinder’s SLAAC Attack Technique (Source – Securelist)
Spellbinder takes advantage of the Stateless Address Autoconfiguration (SLAAC) process in IPv6, a critical feature that allows devices to self-generate their IP addresses without relying on a DHCP server.
By responding to router solicitation requests and injecting fraudulent router advertisement messages, Spellbinder manipulates the traffic routing of targeted devices, steering it through attacker-controlled infrastructure while remaining undetected by users or security systems.
One of the most alarming aspects of Spellbinder is its ability to selectively target specific connections. Instead of attempting to hijack all network traffic, it can be fine-tuned to focus on high-value targets like corporate email systems, cloud platforms, or financial websites.
This targeted approach minimizes the chances of detection while significantly increasing the attacker’s yield in terms of captured credentials and authentication tokens.
Technical Mechanics Behind Spellbinder’s Attack
At the heart of Spellbinder’s success is its use of ICMPv6 spoofing. The tool sends deceptive Router Advertisement (RA) messages within local networks, tricking victim devices into designating the attacker’s system as the default gateway for specific, high-priority domains.
Compromise Process Overview (Source – Securelist)
Here’s an example of Python code used to generate spoofed Router Advertisement (RA) packets:
Python
def generate_router_advertisement(mac_source, ipv6_source, network_prefix, prefix_length, router_lifetime=9000):
packet = Ether(src=mac_source)/IPv6(src=ipv6_source, dst=”ff02::1″)
packet /= ICMPv6ND_RA(routerlifetime=router_lifetime)
packet /= ICMPv6NDOptPrefixInfo(prefix=network_prefix, prefixlen=prefix_length, L=1, A=1, validlifetime=86400, preferredlifetime=14400)
packet /= ICMPv6NDOptSrcLLAddr(lladdr=mac_source)
return packetWhen this code is run, Spellbinder listens for DNS queries targeting specific domains, quickly replying with manipulated IPv6 addresses that channel traffic through attacker-controlled infrastructure.
This method enables Spellbinder to intercept only selected traffic while keeping all other connections intact, allowing the attack to go largely unnoticed by users and security systems.
The tool also employs techniques to intercept TLS traffic, using dynamically generated certificates to maintain the illusion of secure communication with the victim.
To mitigate such risks, experts advise organizations to closely monitor ICMPv6 traffic, implement Secure Neighbor Discovery (SEND) where feasible, and treat IPv6 security with the same vigilance as IPv4 security.
As more businesses adopt IPv6, tools like Spellbinder underscore the growing necessity for robust security measures that cover both IPv4 and IPv6 protocols comprehensively.
