Evolving Beyond MFA: The Rise of Reverse Proxy-Based AiTM Attacks
While multi-factor authentication (MFA) remains a cornerstone of digital defense, cyber adversaries are now exploiting its blind spots with increasingly refined tactics. Among the most troubling developments is a wave of attacks leveraging adversary-in-the-middle (AiTM) techniques—enabled through reverse proxy infrastructure—that effectively neutralize traditional MFA protections.
Unlike conventional phishing that stops at credential theft, these AiTM operations intercept both login details and the session tokens issued post-authentication, giving attackers seamless, real-time access to user accounts—even when MFA is enabled.
This shift signals a turning point in phishing strategy. Instead of tricking users into submitting credentials on cloned pages, attackers now invisibly relay and capture traffic between victims and legitimate services. By impersonating both sides of the connection, they harvest not only passwords but also the proof of authentication—allowing full session hijacking without triggering security alerts.
Researchers from Cisco Talos have observed that the surge in Phishing-as-a-Service (PhaaS) platforms is making these attacks disturbingly accessible. Tools like EvilProxy, Rockstar 2FA, and Tycoon 2FA are being sold as plug-and-play kits, lowering the technical skill threshold required to orchestrate complex AiTM campaigns. This commodification of advanced attack techniques enables even entry-level cybercriminals to execute MFA bypasses with surgical precision.
Organizations relying solely on basic MFA—such as push-based prompts or time-based one-time passwords—are especially at risk. Once inside, attackers often secure persistent access by enrolling their own MFA devices, locking out legitimate users and complicating incident response efforts.
Inside the Attack: How Reverse Proxy AiTM Works
The method is deceptively straightforward in execution. Victims are lured via phishing links, but instead of being sent directly to a fake login page, they’re routed through an attacker-controlled proxy that mirrors the real service. The victim sees a legitimate login experience—but every interaction is silently intercepted, logged, and relayed by the attacker.
Hijacking Trust: How Reverse Proxies Undermine MFA
In a growing class of phishing attacks, adversaries are deploying reverse proxies to seamlessly insert themselves into authentication flows—capturing everything from credentials to session tokens without raising suspicion.
Rather than spoofing a login page, the attacker stands between the user and the real site, passing traffic in both directions while secretly siphoning off sensitive data. This setup tricks the victim into thinking they’re engaging directly with a trusted service.
What This Looks Like in Action (e.g., Evilginx Configuration)
YAML
phishlets:
microsoft:
hostname: login.microsoft.com
path: “/common/oauth2/authorize”
redirect_url: “https://office.com/”
credentials:
username:
field: “login”
search: “name=’loginfmt’”
password:
field: “password”
search: “name=’passwd’”
This configuration powers a proxy that captures and forwards every interaction. Once the user submits their login details, the attacker transmits them to the real authentication service—triggering a legitimate MFA prompt. When the user confirms the MFA request, the attacker captures the resulting session cookie and immediately gains access, bypassing the entire multi-factor process.
The Core Threat: Real MFA, Real Access—No Alarms
Because the authentication is legitimate and MFA is completed by the user, traditional detection systems see nothing suspicious. The attacker simply reuses the session cookie to assume the victim’s identity.
A Stronger Defense: Hardware-Backed Identity
To counter this, experts now recommend moving beyond legacy MFA models. Solutions like WebAuthn, which rely on device-bound cryptographic credentials and strict origin verification, provide a meaningful defense. These systems ensure that authentication can’t be relayed or faked through a proxy, closing the door on this class of attack.
