AiTM Phishing: Why Session Cookies Are Stolen Despite 2FA

For years, multi-factor authentication (MFA) was considered the gold standard for credential defence. For Canadian CISOs, security leaders, and IT directors, mandating SMS verification codes or mobile push notifications resolved roughly 99% of legacy phishing attacks. Unfortunately, that defensive baseline is being eroded by the rapid rise of Adversary-in-the-Middle (AiTM) phishing frameworks.

Today, an employee can carefully enter their corporate password and approve a push notification on their mobile device, only to inadvertently grant an attacker unrestricted access to their Microsoft 365 environment, Google Workspace, or corporate cloud infrastructure. Threat actors no longer need to brute-force passwords: they bypass identity controls entirely by capturing authenticated sessions. Understanding this mechanics is vital for Canadian organizations aligning their identity architecture with guidance from the Canadian Centre for Cyber Security (CCCS) and frameworks like OSFI Guideline B-13.

How Does an AiTM Phishing Kit Intercept Session Tokens Despite MFA?#

Executive Summary: An AiTM attack operates as an inline reverse proxy that proxies live requests between the target user and the authentic authentication endpoint. Once the employee satisfies the MFA challenge, the legitimate identity provider issues a session cookie, which the attacker intercepts to hijack the active session instantly.

Traditional credential harvesting sites host static, visually cloned login portals that record keystrokes. In contrast, AiTM infrastructure relies on dynamic, real-time proxying:

• The Reverse Proxy Mirror: The threat actor deploys a reverse proxy server under a deceptively crafted domain name. When an employee clicks a malicious link, the attacker's server fetches the actual corporate login interface from the legitimate identity provider (IdP) and renders it dynamically to the user.
• Interception of Primary Credentials: The user submits their corporate username and password. The malicious proxy forwards these credentials to the actual authentication server in real time, which then returns the standard MFA prompt.
• Second-Factor Fulfillment: The employee receives their push notification, authenticator prompt, or SMS code and approves it legitimately. From the user's perspective, the flow mirrors an ordinary single sign-on (SSO) prompt.
• Session Cookie Exfiltration: Upon successful authentication, the legitimate IdP generates an authentication session cookie to maintain state. The AiTM proxy captures this session token in transit, forwards the user to a benign landing page or their actual inbox, and retains the valid token.

Armed with this stolen session token, the adversary injects it directly into their own browser session. They completely bypass the password, the MFA mechanism, and conventional credential updates, gaining entry into cloud environments without triggering initial authentication alarms.

Why Traditional 2FA Methods Fail Against Session Hijacking#

Executive Summary: Legacy MFA factors like SMS OTPs, TOTP authenticators, and push notifications lack cryptographic domain binding. They validate user possession at a specific point in time, but they cannot verify whether the browser is communicating with the legitimate domain or an intermediary proxy.

One-time passcodes delivered via text message or software authenticators share an intrinsic vulnerability: they depend on human entry. Whenever an end user must interpret a string of numbers and type it into a web form, social engineering can trick them into submitting that value into an attacker-controlled proxy.

The Vulnerability of Push Notifications and Number Matching

Even push prompts reinforced with number matching remain susceptible to AiTM interception. The reverse proxy receives the challenge number generated by the legitimate IdP and relays it directly onto the victim's phishing interface, allowing the user to select the matching number on their device without suspecting an interception.

The Mandate for Phishing-Resistant MFA: FIDO2 and Passkeys

To neutralize this vulnerability permanently, Canadian enterprises must transition toward phishing-resistant multi-factor authentication built on FIDO2 and WebAuthn standards:

• Cryptographic Domain Binding: During FIDO2 authentication (utilizing physical security keys or platform Passkeys), the client browser interfaces directly with the hardware security enclave, validating the exact origin URI of the site.
• Automated Failure on Phishing Domains: If an employee navigates to a fraudulent domain (such as login-corporate-portal.ca instead of the genuine tenant URL), the cryptographic key refuses to sign the authentication challenge because the origin mismatch is detected at the protocol layer. The proxy captures zero credentials, and no session cookie is issued.

How to Protect Your Workforce Against AiTM Phishing Attacks#

Deploying physical security keys across distributed Canadian workforces takes planning and infrastructure alignment. While executing that technical roadmap, security leaders can deploy high-impact operational controls to curtail the blast radius of session hijacking.

Enforce Strict Conditional Access Policies

Reduce the viability of stolen session cookies by implementing stringent access control baselines:

• Require Compliant, Managed Devices: Deny cloud sessions originating from unmanaged endpoints that do not meet your Mobile Device Management (MDM) or endpoint compliance baselines.
• Geographic Constraints and Impossible Travel Rules: Flag anomalous session behaviour, such as a session token approved in Toronto or Calgary that issues API requests from an overseas data centre minutes later.
• Token Lifetime Restrictions and Continuous Access Evaluation: Shorten web session timeouts and enable continuous evaluation to revoke tokens promptly upon anomalous network changes.

Train Employees to Scrutinize URLs and Domain Architecture

The fundamental operational flaw of any AiTM campaign is the external domain name: adversaries cannot operate on your true IdP domain. Training employees to inspect browser address bars and recognize deceptive domain structures remains an indispensable human barrier.

Instilling this instinct requires realistic training. With Super Phisher, our simulated phishing platform deployed alongside our security experts, Canadian organizations can expose employees to modern, deceptive scenarios, testing their capacity to catch malicious URLs before entering credentials.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

Building a Unified Cyber Defence Across Technical and Human Controls#

Session-hijacking phishing proves that technical safeguards can be outmaneuvered when attackers pivot their tactics. Relying purely on legacy MFA tools without elevating employee detection capabilities breeds a false sense of security across your operational environment.

The strongest posture combines phishing-resistant FIDO2 authentication, hardened conditional access policies, and continuous workforce immersion against emerging social engineering vectors. If you want to evaluate your workforce resilience against modern identity attacks and build an engaging security culture, book a demo with our team to explore our hands-on platforms.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• Social Engineering on Professional Networks: When a Fake Job Offer Masks an Intrusion (Phishing & Social Engineering) : Discover how threat actors exploit professional networks to deceive Canadian personnel with fake job opportunities and bypass corporate defences.
• Phishing Reporting Rate: Why Canadian CISOs Must Move Beyond Click Rates (Phishing & Social Engineering) : Discover why phishing reporting rates outperform click rates to reduce operational risk, satisfy OSFI B-13, and defend Canadian enterprises.
• Baiting and Weaponized USBs: Why Curiosity Remains a Top Enterprise Breach Vector (Phishing & Social Engineering) : Discover how USB baiting attacks bypass modern corporate perimeters and how Canadian CISOs can foster resilient physical security habits across teams.
• Law and Consulting Firms: Protecting Solicitor-Client Privilege Against Spear-Phishing (Industries & Roles) : Protect solicitor-client privilege from spear-phishing. Discover how Canadian law and consulting firms defend against targeted cyber threats.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and Canadian industry
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)