| name | performing-adversary-in-the-middle-phishing-detection |
| description | Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens. |
| domain | cybersecurity |
| subdomain | phishing-defense |
| tags | ["aitm","evilproxy","evilginx","phishing","mfa-bypass","session-hijacking","reverse-proxy","credential-theft"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"] |
Performing Adversary-in-the-Middle Phishing Detection
Overview
Adversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.
When to Use
- When conducting security assessments that involve performing adversary in the middle phishing detection
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Detection Gaps & Validation
- MFA "success" is not safety: AiTM kits (Evilginx, EvilProxy, Tycoon 2FA, Sneaky 2FA) relay the real login, so the sign-in shows MFA satisfied while the attacker steals the session cookie - a successful MFA event does NOT mean the session is the legitimate user.
- Push/OTP/SMS are all bypassable: only origin-bound FIDO2/WebAuthn (or Windows Hello, CBA) resists AiTM because authentication is bound to the real domain - SMS/voice/push MFA are intercepted by the proxy.
- The signal is the cookie, not the password: alert on a session used from a different IP/ASN/device than the authentication within minutes, on token replay, and on impossible travel between auth and session use.
- Post-compromise tells: inbox-rule creation, new MFA-method registration, and OAuth app consent immediately after sign-in are high-fidelity AiTM follow-ups - monitor all three.
- Infrastructure evasion: kits use Cloudflare Turnstile, CAPTCHA, random URLs, and IP rotation to dodge crawlers and serve a real Microsoft/Okta-looking page - judge on domain/cert and reverse-proxy behavior, not the login screenshot.
- Validate + FP tuning: simulate an AiTM sign-in and confirm Conditional Access/CAE revokes or blocks session replay, FIDO2 blocks capture, and SIEM fires on cookie-reuse-from-new-IP. Baseline VPN/CGNAT and roaming users to avoid flagging legitimate IP changes.
Prerequisites
- Azure AD / Entra ID Conditional Access policies
- SIEM with authentication log ingestion (Azure AD sign-in logs)
- Web proxy with SSL inspection and URL categorization
- Endpoint Detection and Response (EDR) solution
- FIDO2/phishing-resistant MFA capability
