Malte ZanderContents
For attackers, a SaaS product's login page is the direct route to customer data, payments and often into the customers' own systems. Copies now take minutes to build with phishing kits and AI tools, and proxy pages get around classic two-factor login. Find copies through new domains, certificate logs, customer reports and your own logs, get them removed in parallel with the phishing framing, and make phishing useless with phishing-resistant sign-in.
- In Q4 2025, SaaS and webmail providers and social media brands were the most attacked sectors, at 20.3% each (APWG).
- In July 2025, Okta found AI-generated rebuilds of several brands' login pages, with logos and other files hosted on the same trusted platform (Okta).
- Microsoft traced adversary-in-the-middle campaigns against more than 10,000 organizations to the open-source kit Evilginx2 (Microsoft).
- CISA classes app-based codes and push with number matching as vulnerable to phishing, and names FIDO/WebAuthn as phishing-resistant (CISA).
Why is your login page the most valuable target?
Because a SaaS login rarely stands for just one account. A customer's admin account opens their data, user management, integrations and often payment details. Whoever takes it over can create new users, export data or redirect invoices. For attackers, that is more efficient than any break-in, and it starts with a copy of your login page.
Then there is trust. Your customers know your logo and your emails and expect to sign in regularly. An email saying "Your session has expired" with a link to a perfect copy looks completely normal.
How do attackers work today?
Faster and with less effort than a few years ago:
Phishing kits deliver ready-made copies of well-known login pages. Phishing kits explains how they work.
AI tools rebuild a login page from a screenshot or a description, and the files often sit on platforms that filters trust.
Proxy pages relay your real sign-in live while capturing the password, code and session cookie. That is why classic two-factor login doesn't stop them, see Why two-factor login doesn't stop every phishing page.
Domains that look like you, such as [your-brand]-login.com, sso-[your-brand].com or [customer].[your-brand]-app.com, the last pattern aimed at individual customers.
Lures that fit SaaS: "Your trial is ending", "New invoice available", "A document has been shared with you" or "Unusual sign-in detected".
Where can you find copies of your login page?
In five places that together give a good picture:
Newly registered domains with your name, misspellings, homoglyphs or add-ons like login, sso, auth or app.
Certificate Transparency logs, where new TLS certificates for such domains appear publicly. See Reading TLS certificates.
Reports from your customers, easiest through a reporting route on the login page and in your help center.
Support tickets about sign-ins customers don't recognize, or about emails you never sent.
Your own logs. Some copies load your logo, font or stylesheet straight from your server, and unfamiliar referrers give them away. Clusters of sign-ins from unusual networks can also point to a proxy page.
Cloned login pages shows how your team can recognize a copy in an individual case.
What should you do when you find a copy?
Takedown and account protection run in parallel:
Capture evidence: the full link, screenshots on desktop and mobile, the lure email with headers, domain, DNS and hosting data. See Securing evidence of a fake website.
Report it as phishing, in parallel to the host, registrar, DNS provider and Google Safe Browsing. Hosts give phishing reports top priority. If the page sits behind a CDN, see Taking down a site behind Cloudflare.
Secure affected accounts: revoke sessions and tokens, reset passwords and check whether new MFA devices, users or API keys were created.
Inform customers factually and with clear steps. How to warn customers about a fake website includes a template.
Keep the case open. Kits often run under many domains at once, see Linking cases.
How do you make phishing useless?
By making sure stolen inputs are worth nothing:
Offer phishing-resistant sign-in, such as passkeys or security keys based on FIDO/WebAuthn. They bind the sign-in to your real domain, and a copy cannot relay them.
Make it mandatory for admin accounts, at least for accounts with access to user management, payments and integrations.
A single login address on your own domain that never changes and is named the same way everywhere.
No login links in emails. Customers who know you never link straight to sign-in will distrust any email that does.
A security page with your official domains and a reporting route for suspicious links.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains and cloned login pages that use your name. On a schedule, the domain scanner checks up to 20,000 variants of your domains, with typos, homoglyphs and add-ons like login, and through the report widget on your login page customers report a suspicious link in one step. The AI compares every finding with your real login page on desktop and mobile and names what was copied. Phishing has its own framing, the evidence package is compiled automatically, and every report to host, registrar, DNS provider and Google is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedowns in the app.
FAQ
Do passkeys protect against login phishing?
Yes, against the usual phishing pages and proxies. A passkey only works on the domain it was created for. On a copy under someone else's domain, there is nothing to capture.
Do we have to inform customers if accounts were taken over?
That depends on contracts and law, for example duties under data protection law. Clarify it with legal and data protection. This is not legal advice. Informing affected customers directly and early is almost always sensible.
What if the copy is hosted with a large cloud provider?
Then report it there, through the provider's abuse form. The more exact the link and the evidence, the easier it is for the provider to find the page on its network. Still report to the registrar and Google Safe Browsing in parallel.
How often should we look for copies?
Continuously. New domains appear every day, so a scheduled scan and an always-open reporting route for customers belong together.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
Okta Threat Intelligence: v0 used to build phishing sites, 1 July 2025
Microsoft Security: from cookie theft to BEC, AiTM phishing as an entry point to financial fraud, 12 July 2022
CISA: Implementing phishing-resistant MFA, October 2022