Real-time phishing bypasses SSO by exploiting human workflow

At a glance

What this is: This is an analysis of real-time phishing, AiTM relays, and vishing, showing how attackers can complete MFA and inherit valid SSO sessions without defeating the identity stack.

Why it matters: It matters because IAM, PAM, and help-desk workflows often treat a successful login as proof of intent, but this attack path turns authentication into a vehicle for account takeover and persistence.

Context

Real-time phishing is a workflow attack on identity, not a brute-force failure of the login stack. A victim authenticates on a phishing site, the attacker relays the exchange in real time, and the legitimate identity provider issues a valid session to the wrong person.

For IAM teams, the problem sits at the boundary between authentication, help-desk support, and account recovery. The article argues that MFA can succeed technically while still failing to establish user intent, which means SSO trust assumptions need to be evaluated as part of the access path, not after it.

The issue is especially relevant where support teams can reset credentials, enroll devices, or override MFA based on a live conversation. Those are high-risk identity transitions, and they become the attacker’s persistence points once a relayed session has been established.

Key questions

Q: What breaks when legacy MFA is paired with proxy-based phishing attacks?

A: The authentication event can still succeed even though the site is malicious, because the proxy relays the legitimate challenge and captures the resulting session material. That means the user appears compliant at login time while the attacker inherits the session. Control testing must therefore include token replay and session hijack scenarios.

Q: Why do AiTM phishing attacks remain effective against SSO environments?

A: Because they target the authenticated session, not only the password. Even strong credentials can be relayed in real time, and the resulting session tokens may let attackers access downstream apps until the session expires or is revoked. That is why session telemetry matters as much as login telemetry.

Q: What are the signs that help-desk workflows are creating takeover risk?

A: Watch for reset requests, MFA enrollment changes, device registration, and token transfers that are approved on the basis of a phone call or a plausible story. Those are the points where an attacker can turn a temporary compromise into durable access. If staff can accept those requests too easily, the workflow is part of the attack surface.

Q: Should organisations use phishing-resistant MFA or tighten account recovery first?

A: Do both, but prioritise the workflows that create lasting access. Phishing-resistant MFA reduces relay-based login compromise, while recovery controls prevent a valid session from being converted into persistence. If only one is improved, attackers will move to the weaker path and keep the same outcome.

Technical breakdown

How real-time phishing relays a valid login

Real-time phishing, also called adversary-in-the-middle phishing, inserts a malicious proxy between the user and the real service. The victim enters credentials on the fake page, but the attacker forwards them immediately to the legitimate login flow, then relays the MFA prompt back to the victim. Because the exchange happens live, the identity provider sees normal authentication, issues a normal session, and downstream apps trust that session as genuine. The key distinction is timing: the attacker is not harvesting credentials for later use, but borrowing the live authentication ceremony itself.

Practical implication: Treat any flow that can be proxied live as exposed unless the control binds authentication to a non-relayable factor or device.

Why SSO logs can look clean during compromise

SSO and MFA are designed to verify identity at login, not to prove that the person behind the login understands or intends the resulting access. That is why the logs often show successful authentication, issued tokens, and no failed attempts. The security gap is not in protocol correctness but in trust interpretation: the system assumes a legitimate login means legitimate consent. AiTM tools exploit that assumption by preserving the exact sequence the stack expects while redirecting the benefit of the session to an attacker.

Practical implication: Review authentication telemetry alongside workflow state, because a valid session alone is not proof of safe access.

How help-desk workflows become part of the attack path

The attack often becomes durable when support staff are pulled into the chain. A caller claiming to be locked out can induce a reset, token transfer, or device-enrollment exception, and those actions change account state in ways a relay attack cannot. Once the attacker gets a persistence foothold, they can keep access beyond the original session by adding devices, creating tokens, or altering recovery routes. In other words, the compromise moves from proxying login to owning the recovery process.

Practical implication: Classify resets, MFA enrollment, and account recovery as privileged actions that require stronger verification than a normal support interaction.

Threat narrative

Attacker objective: The attacker wants a valid authenticated session that survives the login moment and can be turned into persistent account control.

1. Entry occurs when a victim is directed to a phishing site or coached through a call, and the attacker relays the login in real time rather than storing credentials for later.
2. Credential access succeeds when the victim completes MFA on the legitimate service through the proxy, giving the attacker a valid authenticated session.
3. Escalation follows when help-desk workflows, device enrollment, or account recovery are used to turn a temporary session into durable access.
4. Impact is achieved when the attacker uses that valid session to act inside applications, create persistence, or extend control beyond the original login event.

Breaches seen in the wild

• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.
• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication without intent is the governing failure. This article shows that identity systems can verify who is logging in while failing to verify whether the login reflects the user’s actual intent. That gap matters because modern relay attacks preserve the protocol sequence the stack expects. The implication is that authentication assurance must be judged against workflow trust, not just protocol success.

Human workflow has become part of the identity perimeter. The most important control boundary is no longer only the login form, but the support interaction, account recovery path, and device-enrollment sequence around it. Those are the moments where an attacker can convert a valid session into durable access. Practitioners need to treat those flows as privileged identity transitions, not routine service requests.

Phishing-resistant controls change the trust model, not just the failure rate. The article’s core point is that proxy attacks succeed because the control can be relayed, not because users are careless. Controls that bind authentication to a non-relayable device or user action alter the structure of the attack rather than merely reducing user error. That is the difference between filtering noise and collapsing the attack path.

Help-desk approval is a trust decision, not an administrative convenience. Once support personnel can reset factors or transfer access based on a believable story, the attacker no longer needs to defeat MFA in the technical sense. The governance issue is that account recovery often has weaker assurance than initial enrolment, even though it can create stronger, longer-lived access. The implication is that recovery workflows deserve the same governance rigor as privileged access.

Real-time phishing creates credential event reuse, a distinct control gap. The same authenticated event is being reused across the victim, the proxy, and the downstream session without a fresh trust decision at the point of risk. That is a named concept practitioners should track because it explains why conventional alerts miss the attack and why session issuance alone is no longer a sufficient governance boundary.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Credential event reuse: this is the pattern practitioners should track when a live login can be relayed into a valid session and then reused for support, recovery, or persistence actions. The control failure is not just at the login screen; it is the absence of a fresh trust decision at the moment a session starts to matter.

Security teams should map every place where an authenticated session can trigger a durable identity change, because that is where real-time phishing stops being a login problem and becomes a lifecycle problem. Help-desk exceptions, token creation, and device enrollment should all be treated as trust-bearing actions, not convenience features.

For practitioners

• Reclassify account recovery as privileged access Treat password resets, MFA enrollment, device registration, and token transfer as privileged operations with stronger verification than standard help-desk handling.
• Bind authentication to non-relayable factors Prefer phishing-resistant methods that are anchored to a legitimate device or origin so a proxy cannot complete the exchange in real time.
• Audit support paths for live-call abuse Review every workflow where a caller can persuade staff to override identity controls, especially when the request can be framed as an outage or lockout.
• Check for post-login persistence actions Look for new device enrolment, recovery-route changes, token creation, and forwarding-rule changes immediately after a suspicious login event.
• Separate session success from consent evidence Add a second trust decision for high-risk actions so a valid session alone cannot authorise changes that create durable access.

Key takeaways

• Real-time phishing succeeds because it preserves the expected login sequence while redirecting the resulting session to the attacker.
• The most dangerous part of the attack is not the login itself but the ability to convert a valid session into persistence through support or recovery workflows.
• Controls that resist relay and require a fresh trust decision at high-risk actions are the ones that actually close the gap.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Helpdesk abuse: The manipulation of support processes to obtain resets, unlocks, factor re-enrolment, or other identity changes without rightful authorisation. It succeeds when operational convenience outweighs assurance and when support teams lack strong verification rules for high-risk requests.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.