BG - Authentication Proxy Attacks: Detection, Response and Hunting

Breaking Ground, 10:30 Tuesday

Over five years ago, evilnginx was released, demonstrating the ease of stealing authentication session tokens from MFA-enabled logon processes with a simple reverse proxy. Despite being a well-known technique, few of these attacks were seen in widespread use among cybercrime threat actors, until recently.

The advent of the EvilProxy and similar platforms has given attackers the ability to compromise targets with strong authentication without resorting to burdensome SIM swapping or noisy push fatigue attacks. With nascent …

attacks authentication breaking cybercrime detection hunting logon mfa processes proxy response reverse reverse proxy session simple stealing threat threat actors tokens tuesday well-known