Traditional Multi-Factor Authentication (MFA), specifically SMS tokens and basic push notifications, is no longer a sufficient defense against targeted cyber attacks. Threat intelligence reports confirm a significant rise in Adversary-in-the-Middle (AiTM) phishing campaigns specifically targeting Canadian corporate networks.
AiTM Phishing Attack Flow
[Target User] ===> [Reverse Proxy (EvilProxy)] ===> [Legitimate Portal] |
|
Captures Session Token
|
[Attacker Session Hijack]
|
Redirects Direct Deposit (Workday/HRIS) Anatomy of an AiTM Session Hijack
Unlike conventional phishing pages that harvest static credentials, AiTM frameworks proxy live traffic between the target employee and the legitimate authentication portal (e.g., Microsoft Entra ID or Okta).
1-The Bait: The employee receives a contextually tailored notification regarding tax adjustments, expense approvals, or salary updates.
2-The Proxy Interception: Clicking the link routes the user through an automated reverse-proxy server running frameworks like Mamba 2FA or EvilProxy.
3-Token Theft: The user completes standard 2FA authentication (including OTP or push approval). The reverse proxy intercepts the resulting session cookie and hands it directly to the threat actor.
4-Payroll Diversion: The attacker uses the hijacked session cookie to access enterprise HR systems (e.g., Workday, Ceridian) and alter direct-deposit bank details.
Defending the Identity Perimeter
To counter AiTM vectors, security teams must transition from traditional MFA to Phishing-Resistant Authentication.
- Deploy FIDO2 / Passkeys: Hardware security keys (YubiKeys) and platform-bound passkeys bind authentication directly to the legitimate domain URL, neutralizing reverse-proxy interception.
- Implement Conditional Access Policies: Require device-compliance checks (managed Intune / Jamf status) before allowing access to sensitive corporate portals like HR platforms or financial tools.
- Monitor Session Token Anomalies: Configure automated SIEM rules to flag immediate IP or geographic shifts occurring within active user sessions.
