| name | advr-midd-phis-dtct |
| description | Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens. |
| domain | cybersecurity |
| subdomain | phishing-defense |
| tags | ["aitm","evilproxy","evilginx","phishing","mfa-bypass","session-hijacking","reverse-proxy","credential-theft"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"] |
Performing Adversary-in-the-Middle Phishing Detection
Overview
Adversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.
When to Use
- When conducting security assessments that involve performing adversary in the middle phishing detection
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Azure AD / Entra ID Conditional Access policies
- SIEM with authentication log ingestion (Azure AD sign-in logs)
- Web proxy with SSL inspection and URL categorization
- Endpoint Detection and Response (EDR) solution
- FIDO2/phishing-resistant MFA capability
Key Concepts
How AiTM Works
- Victim receives phishing email with link to attacker-controlled domain
- Attacker domain runs reverse proxy that mirrors legitimate login page
- Victim enters credentials on proxied page; credentials captured in transit
- Reverse proxy forwards credentials to real authentication service
- MFA challenge sent to victim; victim completes MFA on proxied page
- Attacker captures session cookie returned by legitimate service
- Attacker replays session cookie to access victim's account without MFA
Major AiTM Kits (2025)
| Kit | Type | Primary Targets | Evasion |
|---|
| Tycoon 2FA | PhaaS | Microsoft 365, Google | CAPTCHA, Cloudflare turnstile |
| EvilProxy | PhaaS | Microsoft 365, Google, Okta | Random URLs, IP rotation |
| Evilginx | Open-source | Any web application | Custom phishlets |
| Sneaky 2FA | PhaaS | Microsoft 365 | Anti-bot checks |
| NakedPages | PhaaS |
