Phishing kits are evolving faster than identity controls

At a glance

What this is: Arkose Labs describes how phishing kits have evolved into MITM reverse-proxy attacks that steal MFA tokens and session cookies instead of just passwords.

Why it matters: This matters because IAM teams can no longer assume MFA alone will stop account takeover when attackers can relay and harvest live session artefacts.

By the numbers:

• Google typically blocks around 100 million phishing emails daily.
• 92% of businesses report they’ve still received at least one compromised email.

Context

Phishing is a delivery problem that now increasingly becomes an identity problem. The article shows that attackers are no longer relying only on fake login pages and stolen passwords; they are using reverse proxies and phishing kits to intercept the live credentials and session artefacts that identity controls depend on.

For IAM and NHI practitioners, the practical issue is that authentication can succeed while the session is still hostile. If an attacker can relay MFA tokens or cookie material in real time, the control boundary shifts from login success to post-authentication trust, which is where many programmes still have weak visibility.

Key questions

Q: Why do MFA controls fail against reverse-proxy phishing?

A: MFA fails when attackers relay valid credentials and second factors in real time through a hostile proxy. The user appears to authenticate normally, but the attacker captures the session. Phishing-resistant authentication reduces that relay path by binding the login more tightly to the device and origin.

Q: Why do phishing kits with MITM proxies increase account takeover risk?

A: They let attackers operate between the user and the target service, so credentials, MFA tokens and session cookies can be harvested as they are exchanged. That means the attacker does not need to defeat authentication in the abstract; they only need to relabel a legitimate session for malicious use.

Q: How should security teams improve breach defence after an attacker gets in through phishing or stolen credentials?

A: Security teams should focus on post-breach containment, not just perimeter controls. The report shows that phishing and stolen credentials account for a large share of breaches, and that damage depends on how hard it is for attackers to move from the initial foothold to valuable assets. Strong segmentation, least privilege, monitoring, and rapid response reduce the chance that a simple intrusion becomes a costly incident.

Q: What is the difference between credential theft and session hijacking?

A: Credential theft targets usernames and passwords before authentication. Session hijacking targets the authenticated token after login, so the attacker bypasses the sign-in step entirely. In practice, session hijacking is often harder to spot because the activity can look like normal user behaviour until the token is revoked or expires.

Technical breakdown

Why reverse-proxy phishing breaks MFA assumptions

MITM phishing kits sit between the user and the real service, relaying traffic so the victim sees a believable site while the attacker captures the authentication artefacts being exchanged. That matters because MFA often proves only that a legitimate user completed the challenge, not that the browser session is trustworthy. In these attacks, the adversary harvests MFA tokens and session cookies in transit, then replays them against the target. The control failure is not simply weak authentication. It is the assumption that a successful MFA event implies a trustworthy post-login session.

Practical implication: move control attention from login success to session integrity and token replay resistance.

What phishing kits automate beyond email lures

A phishing kit is operational infrastructure, not just a fake page. The article describes scripts, templates, web servers, credential capture storage, dynamic URL generation, redirect pages, geo-blocking and campaign dashboards that let attackers run phishing like a repeatable service. That automation reduces attacker effort and increases campaign scale, which is why the ecosystem keeps producing more resilient variants. For defenders, the significance is that one-off email blocking is insufficient when the campaign stack can evolve across domains, lures and infrastructure layers.

Practical implication: govern phishing as an attack platform with infrastructure, not as isolated malicious messages.

Why login workflow placement matters for phishing controls

The article’s core defensive point is that some controls only work if they sit inside the login or registration flow before the MFA step. Arkose Labs positions its challenge-response token in that workflow so the web server can require proof that the interaction was completed legitimately. This illustrates a broader identity design principle: if a malicious reverse proxy cannot reproduce the required workflow artefact, the attack stalls. The important technical distinction is between verifying a user and verifying the legitimacy of the interaction path.

Practical implication: place phishing-resistance checks in the workflow path where stolen credentials are still unusable.

Threat narrative

Attacker objective: The attacker aims to bypass identity controls, capture a usable authenticated session and complete fraudulent access before the victim or defender can intervene.

1. Entry begins when the user clicks a malicious URL and lands on a reverse-proxied phishing site that mirrors the real service.
2. Credential harvesting occurs when the attacker sniffs usernames, passwords, MFA tokens and session cookies as the victim authenticates.
3. Escalation follows when the stolen session artefacts are replayed against the target service to complete the login or transaction.
4. Impact is account takeover and unauthorized use of the victim session for fraud or downstream compromise.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing has become an identity interception problem, not just a message abuse problem. The decisive risk is no longer whether a user can be tricked into a click, but whether the attacker can turn that click into a live authenticated session. That shifts the control conversation from mailbox filtering to session trust, interaction assurance, and replay resistance. Practitioners should treat phishing kits as identity bypass infrastructure.

Reverse-proxy phishing creates a session trust gap that MFA alone does not close. MFA proves a step was completed, but it does not prove the browser path was honest when the attacker relays the exchange in real time. That is why token theft and cookie replay are now central to phishing risk analysis. The practical implication is that identity assurance has to extend beyond authentication into the legitimacy of the transaction channel.

Adaptive challenge-response belongs in the authentication workflow, not beside it. The article shows that controls can disrupt MITM phishing when they demand workflow artefacts that proxies cannot convincingly reproduce. That makes interaction-aware controls more relevant than static checks once attackers automate lures and credential relay. For identity teams, the lesson is that control placement matters as much as control type.

Phishing kit commoditisation is raising the baseline for identity abuse. Scripts, dashboards, geo-blocking and campaign tooling lower attacker effort and increase campaign durability, which means security teams face an industrialised fraud supply chain. The category is no longer about isolated scam emails; it is about repeatable access acquisition. Practitioners need governance models that assume the attacker can scale and adapt quickly.

MITM phishing exposes the limits of authentication-centric thinking. Identity programmes that stop at login verification are already behind the threat. Once the session is the target, the meaningful boundary becomes post-authentication trust, which pulls IAM, fraud, and bot-management disciplines into the same decision space. Teams should align controls to that combined reality rather than treating phishing as a front-door problem only.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Session trust is the control boundary that phishing kits now target. Once attackers can relay a successful MFA event through a reverse proxy, the programme has to care about whether the interaction path was legitimate, not just whether the user authenticated. That shifts detection and response toward runtime assurance, cookie protection and session containment.

The practical consequence for identity teams is that email security, IAM and fraud controls need to be coordinated around the same abuse path. A phishing campaign that reaches the browser can bypass a well-run inbox stack if the session layer remains trust-based rather than interaction-aware.

For practitioners

• Harden the login workflow against proxy replay Require an interaction artefact inside the login or registration flow that a reverse proxy cannot mint or forward without failing validation. Place the check before MFA completion so stolen tokens are not enough to finish authentication.
• Treat session cookies as high-value secrets Inventory where session cookies, MFA tokens and other authenticated-session artefacts can be captured, replayed or reused. Add monitoring for abnormal session handoff patterns and revoke sessions quickly when the path of authentication looks suspicious.
• Reduce the usefulness of credential phishing at the edge Pair email and web-lure detection with controls that validate the transaction context, because message filtering alone will not stop a reverse-proxy attack that already reached the browser.
• Place phishing-resistant checks before account creation Apply workflow-level checks to registration and first login paths where attackers often establish durable access. If the site can accept a session without proving interaction integrity, the attacker can weaponise the onboarding flow.

Key takeaways

• Phishing kits now act as identity interception tooling, not just email lures, because they can harvest the artefacts that make a session usable.
• The scale and persistence of phishing in the article underline why login success alone is not a sufficient security boundary for IAM programmes.
• Controls that verify the legitimacy of the interaction path, not just the user’s password or MFA step, are the ones most likely to disrupt reverse-proxy phishing.

Key terms

• Reverse Proxy Phishing: A phishing method where an attacker places an intermediary server between the user and the real login service. The user signs in on a fake site that relays the authentication flow, allowing the attacker to capture live credentials and often MFA tokens during the legitimate session.
• Session Cookie Replay: The reuse of an authenticated session cookie by someone other than the original user. In identity governance terms, it means the login succeeded legitimately, but the trust boundary moved from authentication to session possession, making post-authentication monitoring and revocation central to defence.
• Session Assurance: Session assurance is the practice of continuously evaluating whether an active digital session still matches the expected identity, device, and behaviour profile. It goes beyond login verification and asks whether the current interaction still deserves to remain trusted before a payment or privilege change is completed.
• Credential Interception: Credential interception is the capture of authentication material while it is in transit or being processed by a trusted system. In this breach pattern, the attacker does not need to steal each secret individually. Instead, privileged placement lets them collect multiple credentials from one control point.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.