The Research and Education Network Information Sharing & Analysis Center (REN-ISAC) has issued a warning about a growing type of phishing scam that can slip past multi-factor authentication (MFA). MFA is usually a reliable safety measure, but attackers are finding ways to trick both users and systems into letting them in.
How the Scam Works
At the heart of this trick is something called a reverse proxy—basically, a hidden “middleman” that sits between you and the real website.
Step 1: A Convincing Link
It starts with an email that looks trustworthy, asking you to log into something familiar—like your email or online drive.
Step 2: The Fake Doorway
When you click the link, you don’t land on the real login page. Instead, you’re taken to a fake one that secretly passes your information along to the real site. It looks identical, so most people don’t notice.
Step 3: You Log In—So Do They
You type in your username, password, and MFA code. The attacker grabs it all—including the digital “key” that proves you’re logged in. With that, they can access your account directly, without having to go through MFA again.
What’s a Proxy, Anyway?
Think of a proxy like a go-between. Imagine you’re calling a friend, but someone else is on the line, repeating every word. You think you’re talking directly, but that person hears (and can repeat) everything. That’s exactly how a reverse proxy works online—it’s a fake website pretending to be real.
Why It’s a Big Deal
- You believe you’re logging in safely.
- The attacker instantly gets your credentials and MFA code.
- They can now read your emails, steal files, or impersonate you. Even worse, cybercriminals do not need to be experts. Ready-made phishing kits make it easy for almost anyone to run these scams.
How to Protect Yourself
- Think Before You Click: Pause before clicking login links in unexpected emails. Verify with the sender if needed.
- Type the Address Yourself: Instead of clicking, type the site’s address into your browser to avoid fake versions.
- Stay Alert—even with MFA: MFA is powerful, but not foolproof. If something feels off, stop and double-check.