Brand-specific phishing panels are bypassing MFA in real time

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Brand-specific phishing panels clone a single company's workflows, capture credentials and one-time codes live, and can bypass MFA in real time.

Why it matters: It matters because IAM teams must treat phishing resistance, transaction context, and behavioural detection as part of authentication assurance, not just email filtering.

By the numbers:

• Custom phishing panels targeting single brands sell for $600 to $999 on dark web forums.
• One custom phishing panel was priced at $750 for the package.
• The panel listing for Mobile.de starts at $600 for early buyers and rises to $999 for later ones.

Context

Brand-specific phishing panels are bespoke fake login and verification flows built to mirror a single company’s customer journey. In this article, the governance problem is not ordinary phishing volume but authenticity at the interface layer, where the attacker makes the counterfeit session look like the real one long enough to capture trust.

For IAM and fraud teams, that changes the control question from whether an MFA prompt exists to whether the session, device, and transaction context still look consistent after the prompt is solved. When the attacker can see and relay the victim’s input in real time, authentication alone no longer carries the full assurance burden.

Key questions

Q: What breaks when phishing panels can relay MFA codes in real time?

A: The assumption that a second factor creates durable proof of identity breaks down when the attacker can capture and reuse the code during the same session. In practice, OTP-based MFA may still stop bulk fraud, but it does not stop a live relay attack that completes the login before the user notices anything unusual.

Q: Why do brand-specific phishing panels evade standard email security?

A: They evade standard email security because the email, landing page, and follow-on workflow are tailored to a single brand and no longer resemble the patterns static signatures are built to catch. When the scam is personalised and interactive, detection has to shift from known indicators to behaviour and context.

Q: How should security teams detect bespoke phishing campaigns?

A: Use behavioural signals across the full flow, not just message inspection. Look for mismatches in timing, interaction sequence, device posture, location, and login-to-transaction behaviour, because these campaigns often look legitimate in isolation but become anomalous when viewed end to end.

Q: Why do MFA controls still fail against account takeover?

A: MFA reduces password-only compromise, but it does not stop attackers who steal session tokens, hijack browsers, or obtain access through adversary-in-the-middle phishing. Once the token is issued, the service often trusts it until expiry or revocation. That means organisations need continuous session control and behavioural detection, not just stronger login prompts.

Technical breakdown

Why live phishing panels defeat MFA

Live phishing panels are not simple static clone pages. They act as relay systems that proxy the victim’s interaction with the real service, capture usernames, passwords, and one-time codes, then forward them to the attacker fast enough for reuse before the session expires. Because the attacker is watching the exchange in real time, the panel can harvest an MFA code or 3D Secure token and immediately complete the login or payment flow. The control failure is not that MFA is absent, but that the stolen factor is still valid when the attacker uses it.

Practical implication: treat OTP-based MFA as insufficient on its own when the attacker can relay the session live.

How brand-specific cloning increases trust abuse

These panels work because they reproduce the target brand’s logos, workflows, error messages, and secondary prompts with enough fidelity to suppress user suspicion. Many also copy brand-specific verification steps, such as extra security questions or identity uploads, so the fake session feels operationally normal. That lowers the victim’s chance of noticing the compromise and makes the phishing flow compatible with the brand’s own customer experience. In identity terms, the attacker is not just stealing credentials. They are borrowing the brand’s trust contract long enough to finish the transaction.

Practical implication: evaluate whether your verification flows create predictable cues that a counterfeit panel can copy exactly.

Why behavioral detection outperforms signature-based email filters

Signature-based email gateways are built to recognise known malicious indicators, but bespoke phishing campaigns change the email, page, and session behaviour faster than static rules can keep up. These kits also harvest IP address, device type, and location, which helps attackers mimic the victim’s profile and avoid simple fraud checks. Behavioral AI shifts the detection problem to pattern mismatch, looking for unusual timing, context, or sequence even when the message and page look legitimate. That is the central architectural shift in this article.

Practical implication: move detection closer to behaviour, not just message reputation or attachment inspection.

Threat narrative

Attacker objective: The attacker’s objective is to take over the account or complete a fraudulent transaction before the victim or security controls detect the compromise.

1. Entry begins with a brand-specific lure, usually delivered by email, that drives the victim to a counterfeit login or payment page.
2. Credential and token capture occur in real time as the victim enters passwords, OTPs, or 3D Secure codes into the live phishing panel.
3. Escalation follows immediately when the attacker receives instant alerts and uses the captured session data before the victim or the control plane reacts.
4. Impact is account takeover, financial fraud, or both, with the attacker able to reuse the victim profile to launch follow-on targeting.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
• Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Brand fidelity has become a control problem, not just a social-engineering problem: when a counterfeit login flow reproduces the target brand’s exact prompts, the defender is no longer competing only with malicious email content. The real issue is that the user experience itself can be cloned closely enough to preserve trust through the critical moment of authentication. For IAM teams, that means phishing resistance now depends on whether the session can be verified after the user has already been convinced.

Real-time OTP relay collapses the assumption that MFA is a durable second factor: the article shows that the code is not protected simply because it was sent by a second channel. Once a live panel can capture and forward the factor within the same interaction, the control becomes a race condition rather than a barrier. The implication is that authentication assurance must move beyond factor presence toward transaction and device binding.

Behavioural detection is becoming the decisive layer for bespoke phishing: signature-based controls are structurally weak against panels that are custom-built for one brand and one victim path. Abnormal AI’s findings point to a wider identity-security pattern: the more personalised the scam, the less useful static indicators become. The practical conclusion is that behavioural anomalies must be treated as first-class identity signals, not just fraud telemetry.

Ephemeral credential trust debt: these kits exploit a window where credentials, tokens, and session context remain trusted long enough to be reused by an attacker. That trust debt is created by assuming a factor proves identity for the whole interaction instead of only the instant it was presented. Practitioners should read this as a warning that authentication events and authorisation events are no longer safely separable in bespoke phishing scenarios.

Fraud context is now part of IAM assurance: the harvesting of IP address, device type, and location shows that modern phishing is not just stealing secrets, but assembling an identity profile that can be replayed against fraud controls. That blurs the boundary between IAM and fraud teams because the attacker is using the same contextual signals defenders rely on. The programme implication is that context must be validated continuously, not only at login.

From our research library:

• Tycoon 2FA alone accounted for 62% of phishing detected by Microsoft and over 64,000 confirmed incidents.

What this signals

Identity assurance now depends on whether the proof step survives the session: brand-specific phishing panels show that a code can be valid and still not be trustworthy if it is captured and relayed in real time. That should push programmes toward phishing-resistant authentication and context-aware validation, because the attacker is increasingly operating inside the same user journey the defender is trying to protect.

Bespoke phishing turns fraud signals into identity signals: device, location, and browser context are no longer secondary data points. They are part of the attacker’s playbook for making a stolen session look normal, which means IAM, fraud, and security operations need a shared view of anomalous access patterns.

Static filters remain useful, but they no longer define the control boundary: the deeper lesson is that counterfeit brand experiences can now be built with enough fidelity to defeat message-level detection. The reader’s programme should therefore measure resilience at the point of session completion, not just at email delivery.

For practitioners

• Harden authentication against real-time relay Prioritise phishing-resistant authentication methods where the proof step is bound to the origin and session, not just a one-time code that can be replayed through a live panel.
• Tune detections for brand-specific lures Add behavioural models that score unusual sequence, timing, and interaction patterns across email, login, and transaction steps, especially when page branding looks normal.
• Correlate device and location signals Compare claimed user context with observed IP address, device type, and geography before allowing high-risk access or payment actions to proceed.
• Review MFA bypass assumptions Test whether current MFA policies still hold when the attacker can capture and use a code inside the same session, then identify which flows remain vulnerable to relay attacks.
• Separate email trust from identity trust Treat message delivery as only one signal and require additional identity validation when a campaign impersonates a brand with high-fidelity login and verification steps.

Key takeaways

• Brand-specific phishing panels compress the gap between social engineering and account takeover by making the fake session look like the real one until the factor is captured.
• The article shows that live token interception, instant attacker alerts, and detailed target profiling together let attackers defeat MFA and fraud checks in one workflow.
• Practitioners should respond by hardening authentication, validating context continuously, and moving detection from static indicators toward behavioural patterns.

Key terms

• Brand-Specific Phishing Panel: A counterfeit login or verification flow built to impersonate one named brand with high visual and behavioural fidelity. Unlike generic phishing pages, it mirrors brand-specific prompts and workflows so closely that the fake session can capture credentials, one-time codes, and other context without immediate suspicion.
• Real-Time Token Relay: A phishing technique where an attacker captures a one-time code or similar factor and forwards it immediately to the legitimate service before the session expires. The problem is not only theft but timing, because the code remains usable long enough to complete authentication in the attacker’s hands.
• Behavioral Detection: A monitoring approach that looks for unusual activity rather than relying only on static inventories. For SaaS integrations, it detects drift in token use, data movement, timing, and endpoint behavior so teams can spot compromise, misuse, or automation that no longer matches its expected pattern.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.