How Phishing Relay Attacks Bypass MFA
How a Phishing Relay Attack Works
Phishing relay attacks do not break authentication. They sit in the middle of it.
A phishing relay attack inserts an attacker-controlled proxy between the victim and the legitimate login portal. The victim believes they are on the real site. Every credential they enter goes to the attacker first.
The sequence is predictable. The victim receives a phishing email linking to a page that looks identical to the real login portal. They enter their username and password. The attacker’s proxy forwards these to the real site immediately. The real site triggers an MFA challenge. The proxy mirrors that challenge back to the victim. The victim enters their six-digit code or approves a push notification. The attacker forwards the response. The real site authenticates the session.
The exchange takes seconds. The victim has logged in. The attacker has the session.
Why MFA Does Not Stop It
The attack works because the MFA factor arrives at the proxy before it reaches the real site.
SMS codes, time-based OTPs and push notifications all produce something that can be captured in transit. A time-based OTP is valid for 30 to 60 seconds. That is more than enough time for a proxy running at network speed to capture and replay it. The code is valid. The login is legitimate. The site has no way to distinguish between the real user and an attacker presenting the same code.
Push notifications fail for a different reason. The user approves a login request without knowing which site generated it. The proxy intercepts the approved session before it reaches the legitimate service.
The factor exists. The authentication step happens. The attacker gets the access anyway.
The Tools Attackers Use
Tools designed specifically for relay attacks are widely available. Evilginx operates as a reverse proxy, positioning itself between the victim and the real site and capturing credentials, MFA codes and session cookies as they pass through. Modlishka automates the same process. Both are openly available and require no significant technical knowledge to deploy.
These tools handle the complexity of maintaining a live session between the victim, the proxy and the real site in real time. They are the reason relay attacks have scaled from a specialist technique to a standard item in attacker playbooks.
The Cyber Defense Magazine article by Kevin Surace, Chair at Token, covers how these tools are being used in practice and why they have driven a significant proportion of recent ransomware incidents and data breaches.
What 120 Million Exposed Records Tells You
The Cyber Defense Magazine article reported more than 120 million records exposed in a single quarter directly attributable to relay-style attacks. That figure understates the real impact because it counts records, not incidents. A single relay attack on a high-value account can trigger a breach that reaches millions of downstream records.
The volume reflects the economics. Relay attacks are cheap to execute, require no system compromise and succeed against the most widely deployed MFA methods. The tooling is accessible, the technique is repeatable and the payoff is significant.
Until authentication removes the transferable factor, the volume will continue to grow.
What Actually Stops Relay Attacks
The relay attack model depends on a factor that can be captured and forwarded. Remove that factor and the attack has nothing to relay.
FIDO2 authentication eliminates the transferable factor through origin binding. When a user authenticates with a FIDO2-compliant device, the authenticator generates a cryptographic response bound to the specific domain the user is logging into. A relay site operating on a different domain cannot produce a valid challenge. A proxy cannot forward a response that resolves to the wrong origin. The authentication fails before the attacker captures anything useful.
Biometric authenticators that bind the FIDO2 credential to a hardware device and require a live fingerprint match go further. They add a possession factor that cannot be stolen remotely and an identity check that cannot be socially engineered.
