Malte ZanderContents
Two-factor login stops attackers who only have a password, but not a phishing page that works as a live proxy. The proxy shows the victim your real login page, relays password and code in real time and keeps the session cookie that proves the login. Only phishing-resistant methods such as FIDO2 security keys and passkeys, which are bound to your real domain, refuse to work on a copy.
- Microsoft observed an adversary-in-the-middle phishing campaign that targeted more than 10,000 organizations since September 2021 and skipped MFA by stealing session cookies (Microsoft).
- In those cases, payment fraud started as little as five minutes after the theft (Microsoft).
- CISA rates codes from apps and tokens, as well as push with number matching, as vulnerable to phishing (CISA).
How do phishing pages get past two-factor login?
By standing between the victim and your real site and passing everything through. Microsoft calls this adversary-in-the-middle phishing:
The victim opens a link to the attacker's lookalike domain.
The proxy loads your real login page and shows it to the victim. Everything looks and works like the original.
The victim enters the password. The proxy forwards it to your site.
Your site asks for the second factor. The victim enters the code or approves the push, and the proxy forwards that too.
Your site issues a session cookie. The proxy keeps a copy.
The attacker loads the cookie into a browser and is signed in, without needing the password or the code again.
The phishing page holds two encrypted connections, one to the victim and one to your site. The stolen cookie even carries the information that MFA was completed (Microsoft). Kits sold as a service work the same way: LabHost's LabRat tool captured two-factor codes in real time (BleepingComputer).
Which MFA methods can be phished?
Most of the common ones. CISA's assessment, from strongest to weakest (CISA):
| Method | CISA assessment |
|---|---|
| FIDO/WebAuthn, such as security keys and passkeys | Resistant to phishing; push bombing, SS7 and SIM swap attacks do not apply |
| PKI-based, such as smart cards | Resistant to phishing |
| Codes from an authenticator app or token, and push with number matching | Vulnerable to phishing, resistant to push bombing |
| Push without number matching | Vulnerable to push bombing and user error |
| SMS or voice codes | Vulnerable to phishing, SS7 and SIM swap attacks |
What makes MFA phishing-resistant?
Binding the login to the real domain. With FIDO2 and WebAuthn, the browser tells the authenticator which site is asking, and the credential only works for the site it was created on. On a lookalike domain there is simply no matching credential, so the proxy has nothing to relay.
That is why CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication (CISA). Passkeys are FIDO credentials that people already know from their phones.
What else protects your users in the meantime?
Moving everyone to passkeys takes time. Until then, layer these controls:
Number matching for push, which CISA recommends as an interim measure (CISA).
Conditional access that is evaluated every time a stolen session cookie is used (Microsoft).
Device binding: sensitive apps only from registered or managed devices (Okta).
Step-up checks for risky actions such as payments or changes to bank details.
Sign-in monitoring for unusual locations, ISPs and user agents, and for new inbox rules after a sign-in.
Session revocation after an incident. A password reset alone does not end a stolen session.
What can brands do for their customers?
Customers face the same proxies as employees, usually with weaker protection.
Offer passkeys for customer accounts and make them the default for new sign-ups.
Ask again before risky actions, even within a valid session.
Give a domain rule, not only a code rule. In a proxy attack, the customer types the code into what looks like your page. Tell people to enter codes only on your real domain or in your app.
Take proxy domains down fast. Every hour a proxy stays online yields more sessions. Our 24-hour response plan shows the sequence.
Request a demo to see how AI Fraud Protect reports it to host, registrar and Google Safe Browsing at once, with the evidence attached.
FAQ
Is two-factor login useless then?
No. It stops attacks that only use stolen or reused passwords, which are still very common. It just isn't proof against phishing pages that relay the second factor.
Are passkeys phishing-proof?
They are phishing-resistant: a passkey only works on the domain it was created for, so a lookalike cannot use it. Account recovery can still be phished, so secure recovery flows as strictly as the login.
What is an adversary-in-the-middle attack?
A phishing page that relays traffic between the victim and the real website. It captures credentials, codes and the session cookie while the victim logs in normally.
Does a password reset stop an attacker with a stolen session?
Not always. Revoke active sessions and tokens as well, and check for changes the attacker made, such as new inbox rules.
Sources
Microsoft Security: AiTM phishing sites as entry point to financial fraud, 12 July 2022
CISA: Implementing phishing-resistant MFA, October 2022
Okta Threat Intelligence: v0 AI tool used to build phishing sites, 1 July 2025
BleepingComputer: LabHost phishing service disrupted, 18 April 2024