What is reverse proxy phishing?
Instead of cloning the login page, the attacker places a reverse proxy between the victim and the real site. The victim sees the authentic page, because it is: the content comes from the legitimate server. Everything typed passes through the attacker, including the second factor and, above all, the session cookie the server returns.
Why it bypasses multi-factor authentication
MFA protects the moment of authentication, not what comes after. If the attacker captures the already-issued session cookie, they need neither password nor code: they replay it and enter as the user. That is why SMS or app-based codes do not stop this technique.
Which defenses actually work
Passkeys and FIDO2/WebAuthn security keys, because they are cryptographically bound to the real domain and simply do not activate against a proxy. Add conditional access policies that evaluate device and location, lookalike domain detection, and shorter session lifetimes.
Learn more
