Meddler-in-the-Middle Phishing Attacks Explained
Summary: Meddler-in-the-Middle phishing attacks use a reverse-proxy server to relay the legitimate login page directly to the victim's browser, letting attackers capture credentials and relay one-time passwords to defeat 2FA. As of November 2022, campaigns using kits such as Evilginx2 targeted more than 10,000 organizations to steal Microsoft credentials, and a separate attack compromised and copied 130 private repositories at Dropbox.
Key Takeaway: A proxy that shows the real login page over HTTPS defeats both the padlock icon and content-based detection, and the July 2022 Microsoft campaign reached over 10,000 organizations before it was documented. Dropbox's response was to move from OTP to WebAuthn, which is the kind of 2FA decision this attack forces.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026