AI-generated fake login pages ease credential theft, MFA code capture and session hijacking via AiTM
Generative AI is making fake login pages cheaper to build, more convincing and easier to tailor to specific brands, organizations and employees. The article, a contributed piece from Keeper Security, describes how these pages go beyond password theft: they can capture MFA codes or hijack authenticated sessions, giving attackers access to corporate accounts even when MFA is enabled. It cites the 2026 Verizon Data Breach Investigations Report, which found phishing accounted for 44% of the AI-assisted initial-access techniques examined. No specific campaign, actor or IOC is named, and the piece ends with a promotion of Keeper's on-device AI Phishing Protection.
Detalhes técnicos
- Lookalike domains with subtle spelling changes or extra characters, paired with branded replicas of authentication portals and personalized IT-notification lures.
- MFA code harvesting: multi-step login flows are replicated so codes can be used before they expire.
- Adversary-in-the-Middle (AiTM): a fraudulent site proxies authentication in real time, then captures the session cookie or token to bypass further MFA challenges.
- Distribution beyond email: text messages, collaboration platforms and search ads bypass email filters. Newly registered, short-lived domains can evade blocklists and reputation services, and valid HTTPS does not prove legitimacy.
Remediação
- Deploy phishing-resistant MFA (FIDO2 security keys, passkeys) bound to legitimate domains.
- Use browser-level phishing protection to detect lookalike domains and brand impersonation.
- Monitor sign-in locations, new devices and session behavior to catch account takeover.
- Enforce least privilege and just-in-time access.
- Define phishing response procedures: reporting, session revocation, credential resets and investigation.
Linha do tempo
-
AI-generated fake login pages ease credential theft, MFA code capture and session hijacking via AiTM
ler a análise desta fonte ocultar
Generative AI is making fake login pages cheaper to build, more convincing and easier to tailor to specific brands, organizations and employees. The article, a contributed piece from Keeper Security, describes how these pages go beyond password theft: they can capture MFA codes or hijack authenticated sessions, giving attackers access to corporate accounts even when MFA is enabled. It cites the 2026 Verizon Data Breach Investigations Report, which found phishing accounted for 44% of the AI-assisted initial-access techniques examined. No specific campaign, actor or IOC is named, and the piece ends with a promotion of Keeper's on-device AI Phishing Protection.
Technical Details
- Lookalike domains with subtle spelling changes or extra characters, paired with branded replicas of authentication portals and personalized IT-notification lures.
- MFA code harvesting: multi-step login flows are replicated so codes can be used before they expire.
- Adversary-in-the-Middle (AiTM): a fraudulent site proxies authentication in real time, then captures the session cookie or token to bypass further MFA challenges.
- Distribution beyond email: text messages, collaboration platforms and search ads bypass email filters. Newly registered, short-lived domains can evade blocklists and reputation services, and valid HTTPS does not prove legitimacy.
Remediation
- Deploy phishing-resistant MFA (FIDO2 security keys, passkeys) bound to legitimate domains.
- Use browser-level phishing protection to detect lookalike domains and brand impersonation.
- Monitor sign-in locations, new devices and session behavior to catch account takeover.
- Enforce least privilege and just-in-time access.
- Define phishing response procedures: reporting, session revocation, credential resets and investigation.