Sponsored by

Guide

Stopping Reverse-Proxy Phishing: A Visual Guide to the MFA Bypass Threat

Phishing kits and generative AI have cut the cost of launching a convincing campaign to around $50 and half an hour, and reverse-proxy phishing has taken the technique a step further. Instead of serving a static copy of a login page, the attacker places a proxy between the victim and the real site, so every page the victim sees is genuine. The username, password and one-time passcode all pass through in real time, the login succeeds, and the attacker leaves with a live session cookie that lets them operate as the user while device fingerprinting passes normally. This visual guide by Ken Palla of Palla Consulting, a former director at MUFG Union Bank who has worked in online security since 2005, shows how these attacks are built, why SMS and email codes offer little protection against them, and why awareness training alone fades within weeks, with click rates rising from 3.5% to 9.5% sixty days after a session. It closes with three steps to take this week: evaluating real-time phishing detection, auditing which MFA factors can still be intercepted, and reviewing DMARC and browser protections.