A technique that forwards traffic through an attacker-controlled intermediary so login data passes through the attacker before reaching the target service. It is especially dangerous because it can harvest both passwords and live authentication prompts without obviously breaking the user experience.
How Reverse Proxy Credential Capture Works
reverse proxy credential capture sits between the user and the target service, relaying the same pages and prompts the user expects while secretly observing the authentication flow. The key point is that the attacker is not trying to break the login form, but to receive the live session data that passes through it.
This technique is especially effective against modern sign-in experiences because it can collect more than a static password. If a workflow includes one-time codes, push approvals, or session cookies, the intermediary can often capture those values as they are entered or returned, which turns a single interaction into a full account compromise path.
Because the user still sees a convincing login journey, the attack depends on trust in the browsing path rather than obvious malware or visible tampering. That is why it is often associated with phishing infrastructure, adversary-in-the-middle setups, and real-time replay of authentication artifacts.
Why It Is Hard to Spot
Reverse proxy credential capture is difficult to detect because the target site may still render normally and the attacker can preserve the look and timing of the real service. From the user’s perspective, the process can feel like an ordinary authentication challenge, which reduces suspicion and increases completion rates.
The technique also works well against controls that assume a human will notice a suspicious URL or a broken page. If the proxy is configured carefully, the domain, page flow, and post-login behavior can be close enough to the real service that the only visible difference is often absent or too subtle to notice.
That makes browser context, session validation, and post-authentication monitoring more important than any single login control. A successful capture can hand the attacker both the credential and the authenticated session, which means the compromise can continue even after the password is changed if the session remains valid.
Security Implications
The security impact is broader than password theft. A captured live authentication exchange can expose multifactor prompts, federated sign-in assertions, session tokens, and any downstream access that is granted immediately after sign-in.
For many environments, the real risk is account takeover with very little friction. Once an attacker can replay or reuse the intercepted session material, they may bypass later password resets, pivot into email or cloud consoles, and use the compromised account to approve further access or reset other identities.
The technique also creates a strong trust problem for organisations that rely on browser-based authentication alone. Defences that only look for stolen static secrets may miss a compromise that began with a legitimate user interaction and ended with an authenticated attacker session.
For readers who want a broader identity-security lens on how captured credentials and live sessions lead to downstream abuse, Ultimate Guide to NHIs is useful background on secret handling, rotation, and access exposure, while OWASP Non-Human Identity Top 10 covers the control patterns that become important once secrets or tokens are exposed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | Captured live creds and session material are secret-bearing identity assets. |
| NHI-04 — Authentication and Session Security | The attack relays interactive auth and can steal live sessions. | |
| NHI-06 — Detection and Monitoring | Proxy-based capture is often only visible through anomalous auth and session behavior. | |
| Recommendation — Use NHI-02 to reduce exposed secrets and constrain reuse after capture. Apply NHI-04 to harden interactive authentication and bind sessions to trust signals. Use NHI-06 to detect relay patterns, unusual sign-ins, and token abuse. | ||
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | Reverse proxy capture is an AiTM credential interception pattern. |
| T1110 — Brute Force | The technique often pairs with credential abuse and authentication bypass outcomes. | |
| Recommendation — Map observed relays to T1557 and hunt for intermediary-based credential interception. Correlate T1110-style abuse with suspicious login attempts and account takeover signals. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication, and Access Control | The subject directly concerns authentication trust and access establishment. |
| Recommendation — Strengthen PR.AA-01 to validate authentication events and limit trusted access paths. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a session-capture problem, not just a credential theft problem. If the attacker gets the live authentication result, the damage can extend beyond the first factor and into any session or token issued at the end of the flow.
What to watch for: Pay attention to sign-in patterns that suddenly change geography, device posture, or browser characteristics immediately after successful authentication. Rapid token use, unusual session creation, and repeated approval events can all indicate that the sign-in path is being relayed.
Practitioner takeaway: The defensive question is not only whether a password was exposed, but whether the authentication ceremony itself can be safely trusted end to end.
Risk and Threat Considerations
Reverse proxy credential capture is high risk because it turns the user’s normal login behavior into the attack path. The proxy can harvest credentials, session cookies, and live authentication responses in real time, which lets the attacker operate with the victim’s own trust relationship.
Failure mechanism: The victim authenticates through an attacker-controlled intermediary, so the attacker receives the secret or session artifact before the legitimate service sees it. That breaks the assumption that a completed login means the user and endpoint are both trustworthy.
Impact: The usual result is account takeover, session replay, and follow-on access to email, cloud apps, and admin portals. In environments with weak session binding, a stolen live session can remain usable even after the original password is changed.
Related resources from NHI Mgmt Group
- When is a reverse proxy better than a VPN for access control?
- What is the difference between a managed gateway and a reverse proxy in front of a gateway?
- How should security teams govern access when using a reverse proxy as the control point?
- What breaks when a reverse proxy becomes the only access gate?
