An academic partnership between Stony Brook University and Palo Alto Networks uncovered a massive use of tools that will steal authentication cookies mid-stream instead of credentials.
The primary benefit of having two or more authentication factors is that threat actors who only have access to your credentials don’t have everything needed to get logged in as their victim, let alone stay logged in.
But new research from Palo Atlo Networks, reported by The Record, found that threat actors are shifting from the historical methods of bypassing 2FA. Traditionally, real-time phishing attacks were used to either infect a victim computer to steal authentication-related cookies post-authentication or to trick the user into giving up credentials – including SMS-based second-factor authentication details – to log onto a target application.
The new research shows threat actors moving towards a method that is much cleaner and less prone to being discovered - Man-in-the-Middle (MitM) Phishing. With MitM phishing, the cybercriminals insert a reverse proxy in between the victim and the desired application. When the user logs on, instead of stealing the credential and second factor to gain one-time access, the authentication cookie(s) transmitted by the authenticating service are captured.
With the cookies in hand, threat actors can establish a post-authentication session with a web application, making the application act as if the malicious session is legitimate and authenticated.
This is nasty stuff.
You’ll continue to hear headlines that only mention the target platform (e.g., Microsoft 365) and something like “stealing credentials”, but this extra bit of context around exactly how this is accomplished above should have your attention; with 2FA cookies in place, a threat actor has repeat access to a platform like Microsoft 365 instead of just a single session.
In the end, threat actors still need to use phishing and social engineering tactics to trick users into clicking on a link that ultimately points to the target web application. So, by putting users through Security Awareness Training, it’s possible to lessen the risk that this kind of attack will be successful.
