Topic starter
12/06/2026 9:55 pm
TL;DR: Phishing remains the most common cybercrime, with 3.4 billion spam emails sent daily, while 92% of businesses say they have still received at least one compromised email, according to Arkose Labs and cited security reporting. Reverse-proxy phishing kits now harvest MFA tokens and session cookies in transit, which means authentication controls alone are no longer enough.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Man-in-the-Middle Phishing Attacks That Cause MFA Compromise”.
By the numbers:
- Google typically blocks around 100 million phishing emails daily.
- 92% of businesses report they’ve still received at least one compromised email.
Key questions
Q: Why do MFA controls fail against reverse-proxy phishing?
A: MFA fails when attackers relay valid credentials and second factors in real time through a hostile proxy.
Q: Why do phishing kits with MITM proxies increase account takeover risk?
A: They let attackers operate between the user and the target service, so credentials, MFA tokens and session cookies can be harvested as they are exchanged.
A: Security teams should focus on post-breach containment, not just perimeter controls.
Practitioner guidance
- Harden the login workflow against proxy replay Require an interaction artefact inside the login or registration flow that a reverse proxy cannot mint or forward without failing validation.
- Treat session cookies as high-value secrets Inventory where session cookies, MFA tokens and other authenticated-session artefacts can be captured, replayed or reused.
- Reduce the usefulness of credential phishing at the edge Pair email and web-lure detection with controls that validate the transaction context, because message filtering alone will not stop a reverse-proxy attack that already reached the browser.
Bottom line: Phishing kits now act as identity interception tooling, not just email lures, because they can harvest the artefacts that make a session usable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
13/06/2026 12:19 am
Phishing has become an identity interception problem, not just a message abuse problem. The decisive risk is no longer whether a user can be tricked into a click, but whether the attacker can turn that click into a live authenticated session. That shifts the control conversation from mailbox filtering to session trust, interaction assurance, and replay resistance. Practitioners should treat phishing kits as identity bypass infrastructure.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between credential theft and session hijacking?
A: Credential theft targets usernames and passwords before authentication. Session hijacking targets the authenticated token after login, so the attacker bypasses the sign-in step entirely. In practice, session hijacking is often harder to spot because the activity can look like normal user behaviour until the token is revoked or expires.
👉 Read our full editorial: Phishing kits are evolving faster than identity controls
This post was modified 3 days ago by NHI Mgmt Group