State-of-the-art phishing: MFA bypass
Summary: Cisco Talos describes how attackers bypass MFA by inserting a reverse proxy between victim and legitimate site, intercepting the username, password and the authentication cookie returned after the victim approves the MFA prompt. Turnkey Phishing-as-a-Service kits such as Tycoon 2FA, Rockstar 2FA, Evilproxy, Greatness and Mamba 2FA, plus the open-source Evilginx tool first released in 2017, let attackers run these attacks without deep technical knowledge.
Why it matters: WebAuthn, which binds credentials to a specific website origin and would defeat the proxy attack, still makes up a very low percentage of all MFA authentications in six months of Cisco Duo telemetry, so most organizations remain exposed to a stolen cookie that grants full session access.
Read the original at Cisco Talos ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026