Phishing attacks are evolving beyond the theft of usernames and passwords, with cybercriminals increasingly using sophisticated tools to intercept authentication sessions and bypass two-factor authentication (2FA). These attacks exploit the communication between users and legitimate websites, allowing fraudsters to capture sensitive information even when additional security measures are in place.
Research from Stony Brook University and Palo Alto Networks highlights the growing prevalence of man-in-the-middle phishing attacks. By developing a detection tool capable of identifying traffic associated with a specific phishing toolkit, researchers uncovered more than 1,200 phishing sites using techniques designed to defeat 2FA protections. The findings underscore the limitations of traditional authentication defenses and the need for stronger approaches to account security.
Stony Brook University worked with Palo Alto Networks to develop an internet sniffer that detects the presence of traffic unique to one specific phishing tool (out of 13 versions of 3 phishing tools). In 2018 and 2019 researchers found 200 phishing sites. The sniffer, detecting just one tool version, discovered 1,220 sites. The article provides a good description of how these phishing tools work in both the Real-Time Configuration and the Man-in-the-Middle version making it a valuable read to those unfamiliar with these tools:
“In a study published last month, academics from Stony Brook University and security firm Palo Alto Networks said they analyzed 13 versions of these three MitM phishing toolkits and created fingerprints for the web traffic that goes through one of these tools.
They used their findings to develop a tool called PHOCA that could detect if a phishing site was using a reverse proxy—a clear sign that the attacker was trying to bypass 2FA and collect authentication cookies rather than credentials alone.
The researchers said they fed PHOCA with URLs reported by the cybersecurity community as phishing sites between March 2020 and March 2021 and found that 1,220 of these sites were using MitM phishing toolkits.
The number is a significant jump from the roughly 200 phishing sites running reverse proxies that were active in late 2018 and early 2019, according to stats provided at the time to this reporter by late RiskIQ researcher Yonathan Klijnsma.
This rise shows that these tools, and MitM phishing kits in general, have slowly gained in popularity among the cybercrime ecosystem.”
The research demonstrates how quickly sophisticated phishing techniques are becoming more accessible to cybercriminals. Tools that once required considerable technical expertise are increasingly available in packaged forms, enabling attackers to deploy convincing phishing sites and intercept authentication information with greater efficiency.
Man-in-the-middle phishing attacks are particularly concerning because they can undermine the protections organizations expect from two-factor authentication. Rather than simply stealing login credentials, these attacks can capture authentication cookies and session information, potentially allowing criminals to access accounts without repeating the normal login process.
For financial institutions and other organizations handling sensitive customer information, the findings highlight the importance of evaluating authentication security beyond the presence of 2FA alone. Monitoring suspicious sessions, identifying phishing infrastructure, and strengthening account access controls can help reduce exposure to attacks that exploit weaknesses in traditional authentication workflows.
As phishing toolkits become more widespread, organizations must recognize that adding another authentication step does not automatically eliminate account takeover risks. The growing use of man-in-the-middle phishing tools reinforces the need for layered security strategies that address both credential theft and the compromise of authenticated sessions.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
