Reverse-proxy phishing kits can capture a session after the user completes MFA. Phishing-resistant sign-in and session controls close the gap.
Attackers increasingly use reverse-proxy phishing pages that relay a real sign-in to the genuine service. The victim completes their normal password and one-time code, and the attacker captures the resulting session cookie, which can then be replayed without any further challenge.
Why it works
One-time codes and push approvals prove the user is present, but they do not prove the user is on the genuine site. A convincing proxy page can relay both.
What blunts it
- Phishing-resistant authentication such as FIDO2 security keys or passkeys, which are bound to the real site address.
- Conditional access that requires a compliant or managed device for sensitive applications.
- Shorter session lifetimes and re-authentication for high-risk actions, and token protections where your identity provider supports them.
- Detection of sign-ins from new devices, unusual locations or impossible travel, plus rules for new mailbox forwarding and inbox rules after a sign-in.
- An easy way for staff to report suspicious messages, with a fast response when they do.
Severity is NAPSECURE's assessment for typical enterprise environments and is not a substitute for the vendor's notice. Verify affected versions in your own estate.