The use of multi-factor authentication (MFA), which needs the user to enter a code or sign in to an additional app in order to log in to their account, has grown in recent years, as it's commonly seen as one of the simplest tools that organisations and individuals can deploy across accounts in order to help keep them secure.
Phishing attacks are evolving in order to help hackers bypass multi-factor authentication protections designed to stop cyber criminals from exploiting stolen usernames and passwords for accounts.
Phishing kits have long been a popular tool among cyber criminals, allowing them to harvest credentials and use them – in many cases, they're available on the open web and only cost a few dollars, fuelling large numbers of attacks.
Now phishing kits are boasting tools and techniques that allow cyber criminals to bypass or steal multi-factor authentication tokens. These range from relatively simple open-source kits, to sophisticated kits that come with several layers of obfuscation and modules that allow attackers to steal usernames, passwords, MFA tokens, social security numbers, credit card numbers, and more.
Rather than relying on recreating a target website, as phishing usually might, these kits instead take advantage of reverse proxy servers – applications that sit between the internet and the web server in order to help services run smoothly.
