Defeating Adversary-in-the-Middle (AiTM) Phishing & Session Token Theft

The Mechanics of Modern Reverse Proxy Attacks

Adversary-in-the-Middle frameworks like Evilginx and Modlishka place a proxy server directly between the victim and Microsoft's legitimate login portal. When the victim enters their credentials and approves a one-time code or push notification, the attacker captures the session cookie (ESTSAUTH, ESTSAUTHPERSISTENT).

Why Standard MFA Fails Against Session Theft

Because the session token represents an already authenticated state, the attacker imports the stolen cookie into their own browser and gains immediate access to the victim's inbox and OneDrive without ever seeing or cracking the password. Standard SMS, email OTP, and mobile push notifications offer zero protection against this vector.

The Phishing-Resistant Solution: FIDO2 and Windows Hello

The only cryptographic defense against AiTM phishing is phishing-resistant authentication based on FIDO2 WebAuthn or Windows Hello for Business. Because FIDO2 binds the cryptographic credential to the specific origin URL in the browser address bar, the credentials will never authenticate against a proxy domain.