Over 1200 Man-in-the-Middle Phishing Toolkits Designed to Intercept 2FA Found in the Wild

Phishing Toolkits Design to Intercept 2FAAn academic partnership between Stony Brook University and Palo Alto Networks uncovered a massive use of tools that will steal authentication cookies mid-stream instead of credentials.

The primary benefit of having two or more authentication factors is that threat actors who only have access to your credentials don’t have everything needed to get logged in as their victim, let alone stay logged in.

But new research from Palo Atlo Networks, reported by The Record, found that threat actors are shifting from the historical methods of bypassing 2FA. Traditionally, real-time phishing attacks were used to either infect a victim computer to steal authentication-related cookies post-authentication or to trick the user into giving up credentials – including SMS-based second-factor authentication details – to log onto a target application.

The new research shows threat actors moving towards a method that is much cleaner and less prone to being discovered - Man-in-the-Middle (MitM) Phishing. With MitM phishing, the cybercriminals insert a reverse proxy in between the victim and the desired application. When the user logs on, instead of stealing the credential and second factor to gain one-time access, the authentication cookie(s) transmitted by the authenticating service are captured.

With the cookies in hand, threat actors can establish a post-authentication session with a web application, making the application act as if the malicious session is legitimate and authenticated.

This is nasty stuff.

You’ll continue to hear headlines that only mention the target platform (e.g., Microsoft 365) and something like “stealing credentials”, but this extra bit of context around exactly how this is accomplished above should have your attention; with 2FA cookies in place, a threat actor has repeat access to a platform like Microsoft 365 instead of just a single session.

In the end, threat actors still need to use phishing and social engineering tactics to trick users into clicking on a link that ultimately points to the target web application. So, by putting users through Security Awareness Training, it’s possible to lessen the risk that this kind of attack will be successful.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews