Topic starter
06/07/2026 9:44 am
TL;DR: Reverse-proxy phishing still defeats MFA by capturing credentials and one-time passcodes in real time, according to Arkose Labs, while attackers continue to industrialise phishing with high-volume infrastructure and cybercrime-as-a-service tooling. Session-bound verification and adaptive mitigation now matter as much as login factors.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “MFA Compromise: Reverse-proxy Phishing Solution”.
By the numbers:
- 58% increase in phishing attacks in 2023, according to Zscaler research cited by Arkose Labs.
- A new phishing site is created every 11 seconds, according to DataProt research cited by Arkose Labs.
Key questions
Q: How should security teams stop reverse proxy phishing from bypassing MFA?
A: Use controls that inspect the session path, not just the credential outcome.
Q: Why do MFA controls fail against reverse-proxy phishing?
A: MFA fails when attackers relay valid credentials and second factors in real time through a hostile proxy.
Q: What are the warning signs that a login may be going through a phishing proxy?
A: Common indicators include unusual domain churn, mismatched page behaviour, repeated challenge prompts, suspicious browser or device signals, and login paths that look valid but fail normal user patterns.
Practitioner guidance
- Bind authentication to live session context Require step-up decisions that incorporate device, browser, geolocation, and session continuity so a relayed login is harder to reuse outside the original interaction.
- Add proxy-resistant verification paths Prefer authentication flows and challenge methods that are less tolerant of real-time relays, especially for high-risk consumer and admin journeys where account takeover has high impact.
- Tune detection for high-churn phishing infrastructure Monitor for short-lived domains, mismatched origin signals, and suspicious relay behaviour across login pages so newly created proxy sites are flagged quickly.
Bottom line: Reverse-proxy phishing keeps MFA compromise viable because attackers can relay the entire login flow in real time and reuse the session immediately.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:01 am
MFA is not the control that fails here, session trust is. Reverse-proxy phishing succeeds because the attacker preserves the user experience while changing the trust path underneath it. That means the important question is not whether MFA was present, but whether the authentication event was still trustworthy once relayed through an attacker-controlled proxy. Practitioners should treat session integrity as the real boundary.
Session-bound verification: MFA no longer deserves to be treated as a final trust verdict. Once reverse-proxy phishing can relay the login live, the real control question becomes whether the authentication event is bound tightly enough to the browser, device, and transaction to remain trustworthy after the fact.
A question worth separating out:
Q: What should organisations prioritise when phishing infrastructure is automated at scale?
A: They should prioritise runtime detection and rapid mitigation over static blocking alone. When adversaries can create and replace proxy sites quickly, the winning control is the ability to evaluate risk during the session and respond before credentials and passcodes can be turned into account takeover.
👉 Read our full editorial: MFA compromise through reverse-proxy phishing is still a live risk