Phishing is still defeating account controls before detection catches up

At a glance

What this is: This is a Transmit Security analysis of how phishing sites, reverse proxies and credential reuse defeat account controls before defenders can respond.

Why it matters: It matters because IAM and fraud teams need controls that survive credential interception, session theft and rapid post-login abuse, not just password checks.

By the numbers:

• Phishing was involved in 36% of all data breaches in 2022, according to Verizon's Data Breach Incident Report cited by Transmit Security.
• Breaches caused by phishing took an average of 295 days to identify and contain in 2022, according to IBM cited by Transmit Security.

Context

Phishing remains a control problem because the attacker does not need to break the application first. They only need a user to authenticate into a convincing spoofed site or reverse-proxied login flow, then they can reuse the captured session or credentials against the real service. In identity terms, the failure is not just initial compromise but the gap between credential capture, session abuse and detection.

The article focuses on consumer account takeover, but the governance lesson applies across identity programmes. Human IAM, fraud controls and downstream NHI protections all depend on the same assumption that authentication events can be trusted long enough to act on. When phishing breaks that assumption, MFA, device checks and behavioural controls have to detect malicious use after login, not merely block the login page.

Key questions

Q: What breaks when users complete MFA on a phishing site that proxies Okta login traffic?

A: What breaks is the trust boundary between the user’s browser and the identity provider. The victim may successfully authenticate, but the attacker captures the resulting session cookie and reuses it to take over the account. That means MFA completion alone does not prove the session is safe. If the session token is stolen, the attacker can often move into connected SaaS applications through SSO.

Q: Why do stolen credentials still lead to account takeover in mature environments?

A: Because authentication alone does not prove intent or legitimacy. If attackers can reuse valid credentials, bypass weak recovery flows, or blend into normal session patterns, they can still gain control. Mature environments need contextual detection, not just strong passwords or MFA in isolation.

Q: What are the signs that a phishing control stack is failing in practice?

A: A failing stack shows repeated novel phishing pages that are not blocked until after users interact, long delays between discovery and enforcement, and dependence on manual investigation before action. If your controls only work after a page has already been used in an attack, they are operating post mortem rather than preventing compromise. That is a visibility gap, not a tuning problem.

Q: How should security teams evaluate passwordless authentication versus traditional MFA in phishing-heavy environments?

A: Security teams should assess whether the control removes shared secrets from the authentication flow, not just whether it adds another factor. Passwordless approaches that still rely on hidden passwords or shared links can leave phishing and replay paths intact. The safer choice is phishing-resistant MFA built on public key cryptography, because it reduces interceptable credentials and improves resilience against account takeover.

Technical breakdown

How reverse proxy phishing defeats MFA

Reverse proxy phishing works by relaying the victim's login session through attacker-controlled infrastructure while preserving the look and feel of the legitimate site. The user enters credentials and completes MFA on what appears to be the real page, but the proxy captures session cookies or tokens after the trust boundary has already been crossed. This is why phishing kits that support live proxying are more dangerous than static fake pages: they convert authentication into a token theft problem, not just a password theft problem.

Practical implication: design controls to detect session hijacking and token replay, not only failed password submission.

Spoofed sites and domain lookalikes as the entry layer

A spoofed site usually combines lookalike domains, copied branding, cloned scripts and redirect chains to create a believable entry point. The attacker may add HTTPS, device emulation or reused page assets to reduce suspicion, but the real objective is to get the user to supply credentials inside attacker-visible infrastructure. In this model, domain reputation, redirect analysis and browser-level telemetry matter because the phishing page itself is part of the attack chain, not just the delivery vehicle.

Practical implication: monitor lookalike domains, redirect behaviour and web reputation signals as part of account takeover defence.

Why stolen credentials still matter after login

Once credentials are harvested, attackers often move quickly to account takeover, fraudulent transactions and credential stuffing on other services. The article also notes that some campaigns install malware, which can widen the breach beyond a single account to persistent access or broader data theft. That creates a governance problem for identity teams: the same login event can become both a fraud trigger and a downstream access-risk event, depending on how fast the organisation detects anomalous use.

Practical implication: correlate authentication, behavioural and transaction signals so stolen credentials are not treated as a single-point incident.

Threat narrative

Attacker objective: The attacker wants durable account access that can be monetised through fraud, data theft and credential reuse before the victim or defender can intervene.

1. Entry begins when the victim clicks an urgent or enticing message and lands on a spoofed website that mimics a trusted brand.
2. Credential access follows when the user submits a username, password and, in some cases, completes MFA through a reverse proxy that captures tokens or session cookies.
3. Escalation occurs when the attacker reuses the captured access to log in, take over the account and perform fraudulent activity before defenders detect the abuse.
4. Impact expands when the same credentials are reused in credential stuffing attacks and stolen data is sold or monetised across other services.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential interception, not password theft, is now the primary phishing failure mode: Modern phishing increasingly captures session tokens and MFA outcomes, which means the control failure happens after authentication appears successful. That shifts the problem from credential secrecy to session trust and token replay resistance. Practitioners should treat every login as a potential handoff into attacker-controlled infrastructure until the session proves otherwise.

Identity controls that stop at the login prompt are incomplete: The article shows why spoofed domains, redirect chains and cloned pages can deliver a convincing authentication experience while the attacker still wins. The real gap is that most account protection still assumes the login page is the boundary. In practice, the boundary is the post-login session, where fraud, account takeover and credential stuffing actually begin.

Phishing creates a governance overlap between human IAM and non-human identity risk: Stolen human credentials frequently become the initial trust anchor for downstream abuse, including automated stuffing, scripted fraud and token replay. That means identity governance cannot be organised as separate human and machine silos when the compromise chain crosses both. The programme needs one view of trust, session and reuse across the entire identity estate.

Continuous detection is a control, but not a substitute for non-phishable authentication: Behavioural biometrics, device signals and domain analytics reduce dwell time, yet they still operate after an attacker has reached the login flow. The stronger design choice is to pair those controls with credentials that cannot be extracted and replayed in the first place. Practitioners should measure phishing resilience by how much attacker utility remains after capture, not by login success rates.

Identity blast radius is the right concept for phishing response: A stolen credential does not just open one account, it creates a time-bound opportunity to move into other services, other sessions and other monetisation paths. That is why the relevant question is not whether phishing was detected eventually, but how far the attacker could travel before trust collapsed. IAM, fraud and security teams should govern that blast radius as a first-class risk metric.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
• Read next: Cloud PAM and CIEM Guide

What this signals

Credential interception is the failure mode that matters most: phishing is no longer only a fake-email problem. Once a user authenticates through a proxy or spoofed page, the control question shifts to whether the session can be replayed, reused or stuffed elsewhere before trust collapses.

Non-phishable authentication changes the economics of account takeover: passkeys and device-bound credentials reduce the value of stolen secrets, but they do not remove the need for behavioural and reputation signals. Identity teams should design for layered trust, with issuance, session and transaction controls all contributing to the decision.

Identity blast radius should become a programme metric: if a credential is captured, the important question is how far an attacker can move before detection, not whether the initial phishing page was blocked eventually. That perspective forces IAM and fraud teams to align around containment, not just login success rates.

For practitioners

• Harden session-level detection Correlate device reputation, redirect patterns, cookie anomalies and behavioural biometrics so that a valid login from a spoofed site is still treated as suspicious.
• Reduce replay value in authentication Prioritise passkeys and other non-phishable credentials for customer flows where credential interception and MFA proxying are common attack paths.
• Instrument lookalike-domain monitoring Track domain variations, certificate use and redirect chains around your brand so phishing infrastructure is detected before large-scale credential harvesting starts.
• Connect fraud and identity telemetry Join authentication events to transaction signals and account-change activity so post-login abuse is visible as part of the same incident picture.

Key takeaways

• Phishing succeeds because attackers can steal or relay usable authentication artefacts before account controls detect the fraud.
• The most important evidence is not just initial credential capture, but the attacker's ability to reuse the same access across sessions and services.
• Teams should harden session-level detection and reduce replay value by prioritising non-phishable authentication for high-risk journeys.

Key terms

• Phishing proxy: A phishing proxy is a fake login site or relay service that mimics a real authentication page and forwards the victim’s credentials and session data to the genuine service. It defeats controls that rely on the user entering reusable secrets into a trusted-looking prompt.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.