Phishing kits act as reverse proxies: the victim sees a convincing page, enters credentials and completes MFA on the real site through the attacker’s relay, and the attacker obtains a usable session cookie. This defeats SMS codes, one-time passwords, and push approvals — the factors are correct, but they are relayed rather than bound to the legitimate origin.
The defense boundary is cryptographic binding, not better judgment. Phishing-resistant authentication — passkeys, FIDO2/WebAuthn, certificate-based methods — ties the credential response to the legitimate origin, so a proxied page receives nothing replayable. Session protections shorten the window even when a token is stolen.
Key points
MechanismThe attacker relays the real sign-in flow in real time, harvests credentials and the post-authentication session token, then uses the session from their own infrastructure.
Detection signalsImpossible-travel or abnormal sign-in geography, new session characteristics after a recent login, token reuse from unexpected clients, and the phishing-domain infrastructure itself.
DefensePrefer phishing-resistant authenticators for high-risk users, bind and shorten sessions, alert on token reuse and anomalous session properties, and revoke sessions on suspicion.
Important limitationPhishing-resistant authentication protects the credential exchange, not the session after it. A stolen post-authentication token, a malicious OAuth consent, or a compromised endpoint still grants access without defeating any factor.