The Death of Conventional MFA: How AiTM Attacks Are Changing the Game
summary
Researchers report a sharp rise in Adversary‑in‑the‑Middle (AiTM) phishing that reliably bypasses many MFA methods by proxying logins and capturing session cookie theft and tokens; attackers rent turnkey infrastructure from phishing-as-a-service operators (evilproxy) or adapt kits like Evilginx, then automate API calls to exfiltrate mail and code within minutes. A captured campaign shows Azure/GCP‑hosted phishing pages, browser fingerprinting, and a working admin panel logging credentials and cookies. Recommended defenses: FIDO2/hardware tokens, number‑matching, full TLS inspection, zero trust and inline DLP.
AI-written summary · about
chapters (20)
- 0:00Introduction and overview
- 0:42MFA in the enterprise
- 2:59Types of MFA implementation
- 3:52Evolving threat landscape
- 4:49Self-enrollment abuse
- 6:17SIM swapping attacks
- 7:54Phishing with real-time chat
- 10:25MFA fatigue attacks
- 12:40Adversary-in-the-middle
- 14:48Open source phishing kits
- 17:25Phishing as a service
- 20:13Real-world campaign analysis
- 23:22Live attack demonstration
- 26:46Targeting GitHub and developers
- 28:47Attacker infrastructure analysis
- 32:40Adversary collaboration
- 34:35Impact of MFA breaches
- 37:39Defensive strategies
- 41:06Summary and best practices
- 42:52Q&A session
related talks
42mSeeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks
26mMake MFA More Resilient
47mBreaking the Next Factor – Live Multi-Factor Authentication (MFA) Hacking
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
42mBreaking the Next Factor - Evil will pwn you LIVE tonight
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
55mAzure Attacks Unpacked: Real-World Threats & Lessons
45mMFA: Stories that make you go 'Huh?'