Phishing & Scams

Phishing That Beats Two-Factor Authentication — How Real-Time Proxies Work

Modern phishing kits act as a live relay of the real website, capturing your password and your OTP simultaneously. Here's how it works and what still stops it.

By AdsBlocks Team·October 24, 2026

Phishing That Beats Two-Factor Authentication — How Real-Time Proxies Work

The Attack That Breaks SMS and App-Based 2FA

For years, security advice has centered on one recommendation: enable two-factor authentication. For most threats, this advice still holds. But there's a category of attack that makes SMS and app-based 2FA insufficient: the adversary-in-the-middle (AiTM) phishing proxy.

These attacks don't break 2FA by cracking codes. They defeat it by relaying it in real time.

How a Phishing Proxy Works

You receive a convincing phishing link — in email, SMS, or a social media message

You visit the fake site, which looks identical to the real one

The fake site is actually a proxy — every action you take is forwarded to the real website in real time

You enter your username and password — the proxy forwards them to the real site and logs them

The real site sends a 2FA code to your phone — the proxy displays a 2FA prompt on the fake site

You enter the code — the proxy forwards it to the real site immediately, before it expires

The proxy captures your session cookie — the authenticated session token that keeps you logged in

At this point, the attacker has your session cookie and can impersonate you without needing your password or 2FA again. The cookie remains valid until it expires or you log out.

Tools like Evilginx, Modlishka, and Muraena have made this attack accessible to attackers with minimal technical skill. These are openly available and widely used.

What 2FA Methods Are Defeated

SMS-based 2FA: Completely defeated. The code is relayed in real time.

Authenticator app TOTP (Google Authenticator, Authy): Defeated. The 6-digit code is valid for 30 seconds — more than enough time to relay it.

Email-based verification codes: Defeated by the same relay mechanism.

What Actually Stops AiTM Attacks

Hardware security keys (FIDO2/WebAuthn): These are the gold standard. When you authenticate with a YubiKey or similar device, the key cryptographically verifies that it is communicating with the legitimate domain. A phishing proxy cannot satisfy this check because it is on a different domain. The authentication simply fails.

Passkeys: Work on the same cryptographic principle as hardware keys and provide the same protection. Google, Apple, Microsoft, and most major services now support passkeys.

Practical Guidance

For your most critical accounts (email, banking, work accounts): use a hardware security key or passkey

For everything else: app-based TOTP is still much better than SMS 2FA, which can also be defeated by SIM swap

Recognize the pattern: AiTM phishing often targets you through an email asking you to review a shared document, confirm account activity, or verify a transaction — always navigate to sites directly rather than through links

Check the domain carefully: AiTM proxy domains are always different from the real domain, even if they look similar at a glance

Bottom Line

2FA remains important, but the type of 2FA matters. SMS and authenticator apps can be defeated by real-time phishing proxies. Hardware security keys and passkeys cannot. For your most important accounts, upgrade to one of these.

Protect Yourself Today

The #1-rated antivirus covers all the threats mentioned in this article.

Get TotalAV — $1.99/month →