Ask a room of employees what phishing looks like and most will describe a badly spelled email from a stranger. That mental model is a decade out of date — and attackers know it. Modern phishing is a polished, real-time operation that can defeat the protections most people rely on, including app-based MFA.

This article dissects a contemporary phishing campaign piece by piece, so you can see exactly where the old defenses fail and which controls actually hold.

The Fall of Traditional MFA Against Adversary-in-the-Middle (AiTM)

Many users believe having SMS codes or authenticator apps makes them completely immune to phishing. Unfortunately, AiTM reverse proxy frameworks like Evilginx3 have revolutionized credential harvesting.

How AiTM Proxies Intercept MFA:
[Victim Browser] ---> [Evilginx Proxy Server] ---> [Real Microsoft / Google Login]
       ^                       |                                 |
       |-- Displays Real MFA --|                                 |
       |---------------- Forwards Real Session Cookie -----------|

When a user visits a malicious link:

  1. The proxy server requests the legitimate login page from Microsoft 365 or Okta in real-time.
  2. The user types their legitimate username, password, and 6-digit authenticator code.
  3. The proxy forwards these to Microsoft, receives a validated session cookie (token), and stores it in the attacker's database.
  4. The attacker imports this cookie into their own browser, completely bypassing passwords and MFA!

Generative AI and Hyper-Personalized Pretexting

Adversaries now train local LLMs on company news, LinkedIn updates, and corporate press releases. The resulting emails:

  • Adopt the exact tone and jargon of the company's executive team.
  • Refer to actual ongoing client projects and authentic supplier names.
  • Contain zero spelling or grammar mistakes.

How to Stop Modern Phishing

  • FIDO2 / WebAuthn Hardware Keys: Physical security keys (YubiKeys) bind authentication directly to the exact cryptographic domain name in the browser address bar. Even if a user visits an AiTM proxy, the cryptographic handshake fails automatically.
  • Conditional Access & Device Compliance: Requiring devices to be Intune-managed and healthy before accepting valid authentication cookies.

The Lure Is Only the Beginning

Behind every convincing phishing email sits research. Attackers scrape breach dumps for password patterns, monitor job boards to learn which SaaS tools a company uses, and register lookalike domains weeks in advance so they age past spam-filter heuristics. QR-code lures ("quishing") move the victim from a monitored corporate inbox to an unmonitored personal phone. Voice phishing (vishing) follows up the email, with a caller who already knows the victim's name, manager, and a real project code-name.

Each step is designed to move the target off a defended channel and onto attacker-controlled ground — which is why user training must teach channel discipline ("we never ask you to log in from an email link") rather than typo-spotting.

What Defenders Should Measure

Phishing simulations that count clicks teach little. Mature programs measure report rate and time-to-report: how many employees flag the phish, and how fast. A workforce that reports within minutes turns every inbox into a sensor grid — the security team can pull the campaign from all mailboxes, block the proxy domain, and force-reset the few sessions that were captured. Combined with FIDO2 keys and conditional access, that is what a modern anti-phishing posture actually looks like.

Anatomy of One Real Click

Walk a single AiTM attack minute by minute. 09:02 — an employee receives a flawless "shared document" email referencing a real project. 09:03 — the link opens what looks exactly like the company login, because the proxy is relaying the real site live. 09:04 — password and authenticator code are entered; the proxy harvests the session cookie. 09:05 — the employee is passed through to the real document and suspects nothing. 09:07 — the attacker imports the cookie from another country and opens the mailbox. 09:20 — inbox rules are created to hide replies, and the first internal phishing wave launches from a trusted account. Every control that breaks this chain sits at a specific minute: FIDO2 keys break 09:04 (the key refuses the fake domain), conditional access challenges 09:07 (new device, new country), and anomaly detection on inbox-rule creation flags 09:20. Lay your defenses on the timeline, and the gaps show themselves.

Key Takeaways

  • AiTM reverse proxies steal live session cookies, bypassing passwords and conventional MFA.
  • AI-generated lures are flawless, personalized, and reference real projects and people.
  • FIDO2/WebAuthn hardware keys defeat AiTM by binding credentials to the real domain.
  • Measure reporting speed, not click rates — fast reporters turn phishing into free threat intel.