AiTM Phishing: Why Even 2FA Codes Entered on Fake Pages Are Stolen

For years, the rollout of multi-factor authentication (MFA) was hailed as the definitive defence against credential harvesting. For CISOs and security operations teams, enforcing a time-based SMS code or a mobile push notification stopped 99% of legacy phishing attacks dead in their tracks. Unfortunately, this certainty is unravelling rapidly with the widespread emergence of Adversary-in-the-Middle (AiTM) phishing kits.

Today, an employee can meticulously enter their corporate password and approve their second factor on their smartphone, whilst unwittingly handing over unconditional access to their enterprise email inbox or cloud environment. Threat actors are no longer bothering to crack passwords: they are bypassing access control mechanisms entirely. Understanding this technical methodology is essential for refining your defensive posture and modernising staff training.

How Does an AiTM Phishing Kit Intercept Session Tokens Despite 2FA?#

In summary: An AiTM kit functions as a malicious reverse proxy that relays live requests between the user and the genuine service. Once the user completes the 2FA challenge, the authentic server issues a session cookie, which the attacker intercepts to hijack the active session instantly.

Unlike legacy phishing templates that merely clone the visual style of a login form to harvest keystrokes, an AiTM infrastructure relies on dynamic traffic mediation:

• The reverse proxy relay: The adversary stands up a reverse proxy server under a typo-squatted or lookalike domain. When the victim clicks the malicious link, the threat actor's proxy dynamically fetches the target platform's genuine login page (such as a corporate single sign-on portal) and serves it back to the victim.
• Harvesting the primary credential: The employee submits their username and password. The malicious proxy passes these details directly to the real service in real time, which then triggers the standard second-factor prompt.
• Fulfilling the MFA challenge: The user receives an authenticator prompt or a temporary code and approves it normally. From their perspective, the authentication journey appears identical to their everyday login routine.
• Interception of the session cookie: Once MFA verification succeeds, the legitimate authentication server issues an authentication token (session cookie) to maintain the stateful session. The AiTM proxy snatches this token in flight before redirecting the unsuspecting victim to a benign landing page.

Armed with this valid session cookie, the attacker imports it into their own browser. This circumvents the password, skips the MFA prompt, renders password resets ineffective, and gives immediate access to corporate cloud resources without triggering basic anomalous login warnings.

Why Legacy 2FA Methods Fall Short Against Session Hijacking#

In summary: Traditional MFA methods such as SMS, TOTP authenticator apps, and standard push alerts do not cryptographically bind the authentication handshake to the legitimate domain. They verify user identity at a single point in time, without validating the authenticity of the browser URL.

One-time passcodes generated by mobile apps or sent via SMS share a structural vulnerability: they rely on human transcription. As long as a human can read a code and type it into a browser form, an attacker can trick them into submitting it to a deceptive proxy.

The Limits of Push Notifications and TOTP Codes

Even push notifications enhanced with number matching remain susceptible to AiTM tradecraft. The reverse proxy simply grabs the match number displayed by the genuine server and reflects it onto the fake portal, prompting the employee to select the matching figure on their mobile device without suspicion.

The Case for FIDO2 and Passkeys

To permanently neutralise this attack vector, security architectures are shifting towards phishing-resistant MFA built upon FIDO2 and WebAuthn standards:

• Cryptographic domain binding: During a FIDO2 handshake (using a physical hardware token or a device-bound Passkey), the browser directly queries the local cryptographic authenticator, passing the exact origin URL of the page being viewed.
• Automated failure on spoofed domains: If the user lands on an AiTM domain (such as secure-login-portal.co.uk instead of the genuine provider domain), the cryptographic key refuses to sign the authentication payload because the origins do not align. The proxy receives no valid assertion and cannot obtain a session cookie.

How to Protect Your Workforce Against AiTM Phishing Attacks#

Transitioning an entire estate to hardware keys and Passkeys takes deliberate planning, technical alignment, and time. Alongside this technical shift, several tactical controls can substantially diminish your attack surface.

Hardening Conditional Access Policies

Constrain the usability of stolen session cookies by implementing strict contextual access controls:

• Require compliant and managed devices: Restrict enterprise access strictly to managed devices enrolled in your mobile device management (MDM) platform, rejecting sessions originating from unknown hardware.
• Flag impossible travel and location anomalies: Detect rapid geographic discrepancies, such as an authentication approval occurring in London followed by API requests from another continent minutes later.
• Shorten session lifetimes: Reduce token persistence for sensitive SaaS platforms and corporate portals to compel frequent re-evaluation of user and device risk.

Training Employees to Scrutinise Domain Names

The Achilles' heel of an AiTM attack remains the domain name: an attacker cannot hijack the provider's genuine root domain. Careful inspection of the browser address bar remains an indispensable line of defence.

To build persistent vigilance across your teams, theoretical briefings must be reinforced with realistic exposure. With Super Phisher, our tailored phishing simulation service deployed alongside our experts, your workforce is exposed to modern, nuanced scenarios that test their ability to identify URL manipulation before interacting with sensitive forms.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

Moving Towards Resilient Modern Cyber Defence#

Session-hijacking phishing campaigns illustrate how rapidly attacker tradecraft evolves to bypass static controls. Relying solely on technical tools without adapting human awareness creates a false sense of security that adversaries routinely exploit.

The most robust defence pairs FIDO2 architecture and strict conditional access policies with immersive, continuous user training against next-generation social engineering. Looking to evaluate your workforce resilience against modern deceptive tactics and build an engaging training programme? Book a demo with our team to explore our hands-on security solutions.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• Social Engineering on Professional Networks: Fake Job Offers Hiding Intrusions (Phishing & Social Engineering) : Discover how adversaries exploit professional social networks with fake job offers to bypass perimeter security and compromise enterprise access.
• Phishing Reporting Rate: Why CISOs Must Ditch the Click Rate (Phishing & Social Engineering) : Discover why phishing reporting rates outperform click rates to slash risk exposure and protect your business in minutes. Read our guide.
• USB Baiting Attacks: Why Curiosity Remains a Potent Threat Vector (Phishing & Social Engineering) : Learn how USB baiting attacks compromise enterprise networks and discover the essential physical security controls needed to protect your organisation.
• Law Firms and Consultancies: Defending Client Confidentiality Against Targeted Cyber Attacks (Sectors & Roles) : Discover why law and consultancy firms face spear-phishing attacks and how to protect legal professional privilege with targeted security training.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and sector
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)