Full Report
Threat actors are bypassing MFA with adversary-in-the-middle attacks via reverse proxies. Phishing-as-a-Service tools like Evilproxy make these threats harder to detect.
Analysis Summary
# Tool/Technique: Adversary-in-the-Middle (AiTM) Attacks via Reverse Proxies
## Overview
This describes the methodology used by cybercriminals to bypass Multi-Factor Authentication (MFA) by positioning an attacker's reverse proxy server between the victim and the legitimate website. This allows for the interception of both initial credentials (username/password) and the resulting session authentication cookies after a successful MFA prompt.
## Technical Details
- Type: Technique
- Platform: Web Applications (Client-Server communication)
- Capabilities: Interception of HTTP/S traffic, real-time forwarding of victim requests to legitimate sites, capture of credentials and session cookies.
- First Seen: The concept of AiTM is long-standing, but the proliferation via Phishing-as-a-Service kits is a modern trend (implied recent evolution).
## MITRE ATT&CK Mapping
* T1557 - Man-in-the-Middle
- T1557.001 - Interception Proxies
* T1566 - Phishing
- T1566.001 - Spearphishing Attachment
- T1566.002 - Spearphishing Link (Primary vector for delivering the initial access link)
* T1078 - Valid Accounts
- T1078.004 - Cloud Accounts (Targeted via stolen session cookies)
## Functionality
### Core Capabilities
- **Proxy Establishment:** Setting up a reverse proxy server that mimics the target legitimate login page.
- **Credential Harvesting:** Capturing the victim's username and password as they are sent to the proxy en route to the real server.
- **MFA Triggering:** Allowing the legitimate server to complete the first stage, prompting the victim for MFA via SMS or push notification.
- **Cookie Interception:** Capturing the successful authentication cookie after the victim approves the MFA challenge, which is returned through the proxy.
### Advanced Features
- **Session Hijacking Preparation:** The resulting captured authentication cookie allows the attacker to immediately hijack the victim's session without needing the password or performing the MFA step again during the active session validity period.
- **User Deception:** The victim interacts with the legitimate website content, reducing detection cues typically associated with simple fake landing pages (the URL in the address bar is the main difference).
## Indicators of Compromise
- File Hashes: N/A (Technique, not a specific binary)
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: Communication facilitated through attacker-controlled reverse proxy infrastructure (details not specified, but the activity involves legitimate domain connection followed by immediate redirection/proxying).
- Behavioral Indicators: Anomalous traffic flow where the user session appears to originate from a legitimate site, but the initial connection path involves an unusual intermediate relay hosting the phishing infrastructure.
## Associated Threat Actors
Threat actors utilizing Phishing-as-a-Service (PhaaS) kits such as:
- Tycoon 2FA
- Evilproxy
- Rockstar 2FA
- Greatness
- Mamba 2FA
## Detection Methods
- Signature-based detection: Ineffective against the core AiTM proxy exchange itself, unless specific network artifacts from known PhaaS toolkits are identified.
- Behavioral detection: Monitoring for unusual session establishment patterns, especially where session cookies are observed shortly after initial credential transmission via unconventional intermediaries.
- YARA rules: N/A (Technique-focused)
- *Mitigation focus recommends utilizing WebAuthn.*
## Mitigation Strategies
- **Implement WebAuthn (FIDO2/CTAP):** Adopt passwordless MFA solutions that use public key cryptography, as these prevent the transmission of passwords and negate the utility of intercepted session cookies from the server's perspective.
- **Use Stronger MFA Factors:** Favor cryptographic-based MFA (like hardware keys or platform authenticators) over simple SMS or push notifications which are susceptible to user coercion during an AiTM session.
- **Endpoint Security:** Employ enterprise security solutions like Cisco Secure Firewall, Cisco Umbrella, and Cisco Secure Access to block connections to known malicious proxy domains.
## Related Tools/Techniques
- Phishing-as-a-Service (PhaaS) kits (Tycoon 2FA, Evilproxy, etc.)
- General Adversary-in-the-Middle attacks (T1557)
- Session Hijacking (Post-Cookie Theft)