Topic starter
25/08/2026 6:10 pm
TL;DR: Real-time phishing and vishing let attackers proxy a live login, satisfy MFA, and inherit valid SSO sessions without breaking the authentication stack, according to Trusona's analysis of Tycoon 2FA, Microsoft, Europol, and public advisory data. The real failure is not MFA itself but the assumption that authentication proves consent and that help-desk workflows can safely trust a logged-in session.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “Vishing and Real Time Phishing Kits: A New Age of SSO Bypass”.
Key questions
Q: What breaks when legacy MFA is paired with proxy-based phishing attacks?
A: The authentication event can still succeed even though the site is malicious, because the proxy relays the legitimate challenge and captures the resulting session material.
Q: Why do AiTM phishing attacks remain effective against SSO environments?
A: Because they target the authenticated session, not only the password.
Q: What are the signs that help-desk workflows are creating takeover risk?
A: Watch for reset requests, MFA enrollment changes, device registration, and token transfers that are approved on the basis of a phone call or a plausible story.
Practitioner guidance
- Reclassify account recovery as privileged access Treat password resets, MFA enrollment, device registration, and token transfer as privileged operations with stronger verification than standard help-desk handling.
- Bind authentication to non-relayable factors Prefer phishing-resistant methods that are anchored to a legitimate device or origin so a proxy cannot complete the exchange in real time.
- Audit support paths for live-call abuse Review every workflow where a caller can persuade staff to override identity controls, especially when the request can be framed as an outage or lockout.
Bottom line: Real-time phishing succeeds because it preserves the expected login sequence while redirecting the resulting session to the attacker.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Authentication without intent is the governing failure. This article shows that identity systems can verify who is logging in while failing to verify whether the login reflects the user’s actual intent. That gap matters because modern relay attacks preserve the protocol sequence the stack expects. The implication is that authentication assurance must be judged against workflow trust, not just protocol success.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations use phishing-resistant MFA or tighten account recovery first?
A: Do both, but prioritise the workflows that create lasting access. Phishing-resistant MFA reduces relay-based login compromise, while recovery controls prevent a valid session from being converted into persistence. If only one is improved, attackers will move to the weaker path and keep the same outcome.
👉 Read our full editorial: Real-time phishing bypasses SSO by exploiting human workflow