PH!SH Framework
Framework / Techniques
Technique Data Harvesting

Adversary-in-the-Middle Authentication Proxy

The sign-in page sat between visitors and the real service, passing along whatever was entered. A relay like this can capture passwords, one-time codes, and the signed-in session, even with two-step verification on.

Also known as
Aliases
  • AiTM phishing
  • reverse-proxy phishing
  • man-in-the-middle phishing
Broader terms
  • MFA-bypass phishing
  • token theft
Named examples
  • EvilProxy
  • Evilginx
  • Tycoon 2FA
  • Greatness
  • W3LL Panel
  • Rockstar 2FA
  • Mamba 2FA
  • Sneaky 2FA
  • Salty 2FA
Mapped to
MITRE ATT&CK®
T1557Adversary-in-the-Middle T1539Steal Web Session Cookie T1111Multi-Factor Authentication Interception T1598.003Spearphishing Link

Connected in PH!SH

Themes
TH0009Microsoft Impersonation TH0034Password Expiration Notice TH0035MFA Request TH0036Account Suspension or Deletion Notice TH0037Suspicious Sign-In Alert TH0039Account Details Update TH0045Account Verification Request TH0061Copyright or Platform Policy Violation Notice TH0069Data Breach Notice

Read more