Phishing vs MFA: How Adversary-in-the-Middle (AiTM) Proxies Work and How to Stop Them

What is Adversary-in-the-Middle (AiTM) Phishing?

Traditional phishing campaigns duplicate website HTML and steal submitted usernames and passwords. However, when an account enforces Two-Factor Authentication, stolen passwords alone are insufficient to log in. In response, cybercriminals have deployed Adversary-in-the-Middle (AiTM) reverse proxy frameworks (such as Evilginx).

How the Attack Executes in Real-Time

1. The attacker sends a phishing link pointing to a proxy domain (e.g. login.microsofft-auth.com).
2. When the victim enters their credentials, the proxy forwards them to the real authentication server in real-time.
3. The real server challenges the proxy with a 2FA prompt, which the proxy displays to the victim.
4. The victim inputs their 6-digit TOTP code into the proxy, which forwards it to the authentic server.
5. Upon successful login, the genuine server issues an authenticated session cookie (JWT or session token). The proxy intercepts this session token, allowing the attacker to bypass authentication without needing the 2FA device again.

How to Protect Against Reverse Proxy Attacks

• Verify Domain Names Carefully: Always check the exact address bar URL before typing 2FA tokens.
• Deploy FIDO2 / WebAuthn Hardware Keys: FIDO2 security keys cryptographic bindings are origin-bound to the exact domain name in the browser address bar, making AiTM proxies mathematically impossible to fool.