Adversary-in-the-Middle (AiTM) Phishing: The Rise of MFA-Bypass Techniques via Reverse Proxies

Executive Summary: Adversary-in-the-Middle (AiTM) phishing attacks have evolved into a sophisticated method for bypassing Multi-Factor Authentication (MFA) by leveraging reverse proxy frameworks such as Evilginx. These attacks intercept user credentials and authentication cookies in real time, enabling threat actors to impersonate legitimate users and gain unauthorized access to sensitive systems. As of May 2025, AiTM attacks represent a critical escalation in the cyber threat landscape, necessitating immediate defensive strategies and heightened awareness among organizations and individuals alike.

Key Findings

• MFA Bypass via AiTM: Threat actors are bypassing MFA protections by capturing session cookies and tokens during live authentication sessions using reverse proxy tools like Evilginx.
• Evolution of Evilginx: Originally introduced in 2017, Evilginx has been weaponized to support modular, high-fidelity phishing campaigns that mimic legitimate login portals.
• Real-Time Credential Interception: AiTM attacks occur in real time, allowing attackers to harvest credentials and session tokens without triggering traditional alert mechanisms.
• Enterprise and Consumer Targeting: Both enterprise users (e.g., Microsoft 365, Google Workspace) and consumer-facing platforms are actively targeted due to widespread MFA adoption.
• Detection Evasion: AiTM attacks often evade detection by using legitimate domains, TLS encryption, and spoofed authentication flows.

Mechanism of AiTM MFA Bypass Attacks

Adversary-in-the-Middle phishing attacks operate by positioning a malicious reverse proxy between the victim and the legitimate service. This proxy captures all transmitted data, including usernames, passwords, and MFA tokens, before forwarding the request to the real server. The user remains unaware of the interception, as the login flow appears normal.

The process typically involves:

• Victim receives a phishing email or SMS directing them to a spoofed login page hosted on a domain controlled by the attacker.
• The spoofed page is actually a reverse proxy that relays traffic to the legitimate service (e.g., outlook.com, login.microsoftonline.com).
• When the user enters their credentials and completes MFA (e.g., via SMS, authenticator app, or push notification), the proxy captures the entire session, including the authentication cookie or token.
• The attacker can then replay the captured session token to access the user's account without needing to re-authenticate.

Tools such as Evilginx, Modlishka, and NecroBrowser have been adapted for AiTM campaigns, with Evilginx emerging as a leading framework due to its modular design and support for advanced evasion techniques.

Why MFA is No Longer Enough: A Paradigm Shift in Phishing

While MFA significantly reduces the risk of credential-based attacks, AiTM techniques undermine its effectiveness by targeting the authentication session itself. Traditional MFA methods—such as one-time passwords (OTP) or push notifications—are intercepted during transmission and replayed by the attacker. Once a session token is captured, MFA becomes irrelevant because the attacker inherits an authenticated session.

This shift has prompted threat actors to shift from brute-force and credential stuffing to precision-engineered AiTM phishing, which is harder to detect and more likely to succeed against well-defended organizations.

Real-World Impact and Case Studies (2024–2025)

Recent incidents highlight the growing sophistication of AiTM campaigns:

• A 2024 campaign targeting Microsoft 365 users used Evilginx to harvest authentication tokens from enterprise users, resulting in data exfiltration from multiple Fortune 500 companies.
• In early 2025, a spike in AiTM attacks against financial institutions in EMEA led to unauthorized wire transfers, facilitated by stolen session cookies from mobile banking apps.
• Cybercriminal groups such as Scattered Spider and 0ktapus have been observed integrating AiTM tactics into their operations, combining social engineering with technical interception.

These attacks demonstrate that even organizations with strong MFA policies remain vulnerable unless additional controls are implemented.

Defensive Strategies: Mitigating AiTM Threats

To counter AiTM MFA bypass attacks, organizations must adopt a multi-layered security approach:

1. Session Token Hardening

• Short-Lived Tokens: Enforce time-limited session tokens (e.g., 15–30 minutes) to reduce the window of opportunity for token replay.
• Token Binding: Use token binding techniques (e.g., OAuth token binding, certificate-based authentication) to bind tokens to specific devices or sessions.
• Continuous Authentication: Implement behavioral biometrics or behavioral analytics to detect anomalous session activity in real time.

2. Enhanced Monitoring and Detection

• AI-Driven Anomaly Detection: Deploy machine learning models to detect unusual login patterns, such as rapid authentication attempts from different geographic locations.
• Session Hijacking Alerts: Monitor for multiple concurrent sessions from the same user account, which may indicate token theft.
• DNS and TLS Inspection: Use DNS filtering and TLS inspection to detect proxy-based traffic redirection or spoofed domains.

3. User Education and Phishing Resistance

• Phishing Simulation Training: Conduct regular, high-fidelity phishing simulations that include AiTM-style attacks to improve user vigilance.
• Browser Security Controls: Enforce the use of security-focused browsers or extensions that block known malicious domains and proxy frameworks.
• Multi-Channel Verification: Implement out-of-band verification for high-risk actions (e.g., account changes, wire transfers) via secure channels (e.g., dedicated mobile app, hardware token).

4. Infrastructure and Architecture Controls

• Zero Trust Architecture: Adopt a Zero Trust model where every access request is authenticated, authorized, and encrypted, regardless of origin.
• Network Segmentation: Isolate critical systems and authentication servers to limit lateral movement and reduce exposure.
• Reverse Proxy Monitoring: Monitor internal network traffic for unauthorized reverse proxies or unusual HTTP headers that may indicate AiTM tool usage.

Future Outlook: The Next Evolution of AiTM Attacks

As organizations deploy stricter authentication controls, threat actors are likely to enhance AiTM frameworks with:

• AI-Powered Social Engineering: Use large language models to generate highly personalized phishing messages that evade detection.
• Browser-in-the-Middle (BitM): More advanced attacks that manipulate client-side JavaScript to intercept data before it is encrypted.
• Cloud Service Abuse: Leveraging compromised cloud instances to host AiTM infrastructure, making takedowns more difficult.
• Quantum-Resistant Tokens: As post-quantum cryptography becomes standard, attackers may pivot to exploiting weak legacy token formats.

The convergence of AI, cloud services, and phishing automation will continue to lower the barrier to entry for AiTM attacks, making them a persistent and escalating threat in the cybersecurity landscape.

Recommendations for Organizations and Users

• For Organizations:
  • Conduct a comprehensive MFA risk assessment, focusing on session token security and replay vulnerabilities.
  • Deploy AI-driven security solutions capable of detecting AiTM-style attacks in real time.
  • Enforce conditional access policies that require step-up authentication for high-risk sessions.
  • Regularly audit and revoke long-lived or unused session tokens.
• For Users:
  • Verify the URL and SSL certificate of login pages before entering credentials; use bookmarks for frequently