The $200 Toolkit That Killed Your MFA
For years, security teams have told executives that multi-factor authentication stops phishing. In 2026, that statement is no longer technically accurate. The reason is a commoditized class of phishing infrastructure called adversary-in-the-middle, or AiTM, that you can rent on a dark web marketplace for less than the cost of a mid-tier streaming bundle.
AiTM kits including Tycoon 2FA, Rockstar 2FA, EvilProxy, Greatness, and Mamba 2FA have industrialized session-token theft. They defeat OTP, push notifications, and even hardware tokens used as a second factor. The CrowdStrike 2026 Global Threat Report attributes 82% of detections in 2025 to malware-free identity abuse, and AiTM session theft is the dominant pattern inside that majority.
This post is a technical breakdown. We will look at how AiTM kits work at the HTTP layer, what telemetry signatures detection engineers can hunt, and how Peris.ai builds session-anomaly detection that survives the new normal.
What Is an AiTM Phishing Kit?
An adversary-in-the-middle phishing kit is a reverse proxy that sits between a victim and a legitimate authentication portal. The victim believes they are typing credentials into Microsoft 365 or Google Workspace. They are. The credentials reach the real provider. The MFA challenge fires. The victim approves it. And at the moment the session cookie is issued, the attacker captures it from the proxy, ending the legitimate authentication on the victim side and resuming it on the attacker side.
From the user’s perspective, login worked. From the attacker’s perspective, the user just delivered a fully authenticated session.
Anatomy of the attack flow
- Phishing email or messaging lure points to a look-alike URL.
- The look-alike URL is the AiTM reverse proxy.
- The proxy fetches the legitimate Microsoft or Google login page in real time.
- The victim enters credentials. The proxy relays them.
- The legitimate provider issues an MFA prompt. The victim approves it.
- The session cookie is issued. The proxy logs the cookie and the credentials.
- The attacker replays the session cookie to the legitimate service and is now logged in as the user.
Which MFA Methods Survive AiTM, and Which Do Not?
| MFA Method | AiTM Resistance |
| SMS OTP | None. Cookie theft bypasses entirely. |
| TOTP authenticator | None. Same cookie theft path. |
| Push notification | None. User approves a legitimate prompt. |
| Hardware token as second factor (OTP-generating) | None. Cookie still issued. |
| WebAuthn / FIDO2 / passkeys | Resistant. Cryptographic challenge bound to origin URL, cannot be replayed through proxy. |
WebAuthn and FIDO2 are the only widely deployed phishing-resistant standards. CISA’s Phishing-Resistant MFA Implementation Guidance, updated in 2025, explicitly recommends FIDO2 as the standard for high-value identities.
What Detection Engineers Should Hunt
AiTM activity leaves telemetry, but it lives at the seam between authentication logs and session cookie issuance. Detection engineers should baseline and alert on:
- Successful authentication followed by session cookie issuance to an unexpected source IP within seconds.
- TLS fingerprint anomalies, particularly JA3 or JA4 mismatches between the user’s normal client and the source of cookie reuse.
- User-agent strings that do not match the user’s installed inventory.
- Geographic impossibility patterns: successful login from country A, session token used from country B within sixty seconds.
- Anomalous OAuth consent grants immediately following AiTM-pattern logins, which often persist access after credential rotation.
- Mass campaigns targeting energy, finance, and government sectors via SharePoint and Outlook Web Access proxies, consistent with the January 2026 multi-stage AiTM campaign observed by Microsoft.
The Problem: Why Traditional SIEM Misses AiTM
Most SIEM detections operate on authentication events. From the SIEM’s point of view, the login succeeded, MFA was satisfied, and the session is healthy. The fraudulent reuse of the cookie happens out-of-band, often from a different network, and looks like normal user activity unless behavioral baselines are explicit.
This is the structural reason AiTM has become the dominant initial access vector for BEC, VEC, and ransomware deployment in 2026. The kit is cheap, the defenders’ tooling is misaligned, and the user behaves correctly throughout.
How Peris.ai Detects and Contains AiTM Sessions
Peris.ai’s agentic AI cybersecurity stack treats identity as the new perimeter and correlates authentication events with session behavior in real time. Three components carry the detection load.
XDR for identity threat detection
Our XDR ingests authentication and session-cookie telemetry across Microsoft Entra ID, Google Workspace, Okta, and on-premises identity providers. It compares each successful authentication to the user’s behavioral baseline: typical source IPs, TLS fingerprints, user-agent strings, and session reuse patterns. When the post-authentication session deviates, XDR raises an identity-tier anomaly.
BrahmaFusion for automated session revocation
When XDR raises the alert, BrahmaFusion executes the response playbook in seconds. It revokes the active session, forces a step-up authentication, and isolates downstream systems the user had access to. A Peris.ai telco client reduced response time from 30 minutes to 3.3 minutes after BrahmaFusion deployment. Identity-tier incidents are a perfect fit for that automation gain.
INDRA CTI for AiTM kit infrastructure intelligence
INDRA CTI maintains attribution-grade intelligence on AiTM kit operators: domain registration patterns, hosting providers, TLS fingerprints, and kit-specific signatures. When a phishing URL is flagged in your gateway logs, INDRA CTI tells you which kit family hosted it and which downstream actors typically operate it.
Use Case: From Login to Lockout in Under Five Minutes
A mid-size financial firm using Peris.ai sees the following sequence one afternoon.
- An employee receives a phishing email pointing to a Tycoon 2FA-hosted reverse proxy.
- The employee enters credentials and approves the MFA push.
- Microsoft Entra ID logs a successful authentication. The session cookie is issued.
- Within 1.7 seconds, our XDR observes the same session cookie reused from a source IP previously unseen for this user, with a JA4 TLS fingerprint inconsistent with the user’s known clients.
- INDRA CTI confirms the source IP is part of an active Tycoon 2FA campaign cluster.
- BrahmaFusion revokes the session, forces password reset and step-up to a passkey, and opens an IRP case with the full evidence trail.
- Time from successful proxy login to attacker lockout: under five minutes.
For comparison, without behavioral session detection and automation, similar campaigns historically reach mailbox access, OAuth consent persistence, and downstream BEC within an hour.
Outcomes That Matter
| Benefit | Outcome |
| Session-level behavioral baselines | Detects AiTM session theft within seconds |
| Automated revocation and step-up | Attacker locked out before mailbox or data access |
| AiTM kit attribution | Faster triage and targeted intelligence sharing |
| OAuth grant monitoring | Closes the persistence gap after credential rotation |
| Phishing-resistant MFA orchestration | Step-up to passkeys for high-value identities |
Conclusion
The defining phishing technique of 2026 is not cleverness. It is commodity. AiTM kits at USD 200 per month make MFA bypass the default initial access path, not an edge case. Security teams that still equate MFA with phishing resistance will keep losing identities they thought were protected. The path forward is autonomous threat detection at the session layer, phishing-resistant authentication for high-value identities, and the agentic AI cybersecurity backbone that ties them together. Peris.ai is built for that operating model.
Explore the Peris.ai Automation Layer at brahma.peris.ai.
FAQ
What is an AiTM phishing kit?
An adversary-in-the-middle phishing kit is a reverse proxy framework that relays credentials and MFA prompts between a victim and a legitimate provider, capturing the post-authentication session cookie so the attacker can impersonate the user.
Which AiTM kits are most active in 2026?
Tycoon 2FA, Rockstar 2FA, EvilProxy, Greatness, and Mamba 2FA are the most observed AiTM kits according to Talos Intelligence 2026 reporting and Microsoft Threat Intelligence.
Does WebAuthn stop AiTM phishing?
Yes. WebAuthn and FIDO2 bind the cryptographic challenge to the legitimate origin URL, so a reverse proxy cannot replay the authentication. This is the only widely deployed MFA family that is structurally resistant to AiTM.
What telemetry detects AiTM session theft?
Key signals include session cookie reuse from a new source IP within seconds of legitimate login, JA3 or JA4 TLS fingerprint mismatches, and user-agent strings inconsistent with the user’s known clients. Peris.ai XDR baselines and alerts on these.
How fast can Peris.ai contain an AiTM incident?
Peris.ai customer deployments contain AiTM session theft in under five minutes, with mean response times improved by an order of magnitude over manual SIEM workflows.
Leave a Reply