Reverse-proxy phishing can bypass MFA
A post dated August 9, 2026, describes how phishing kits can relay logins and capture session cookies after multifactor authentication.
Source: Como phishing via reverse proxy pode capturar cookies de sessão após MFA (x.com). Text prepared with AI from this source.
What happened and what to do
A post published on August 9, 2026, describes phishing kits that act as a proxy between a victim and a legitimate service, relaying the login and multifactor authentication (MFA) interaction. After authentication, the attacker can intercept the resulting session cookie. The post cites Evilginx, Modlishka, and Muraena as examples of this attack pattern.
To reduce exposure, a company can review its authentication and session flows, monitor suspicious login and session-use events, and define responses for revoking compromised cookies. An implementation can connect these signals to alerts and security procedures, rather than relying on MFA alone as a defense against phishing.
How the consultancy can help
Wendelmaques can assess exposure in authentication and monitoring flows, propose a scoped implementation, and support its operation, including event collection, alerts, and response procedures for suspicious sessions.
Next step
Send a short description of your authentication environment and phishing concerns to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.