#identity-security — Public Fediverse posts

The Death of Trust: Why Adversary-in-the-Middle and QR Attacks Are Gutting Corporate Defenses

1,408 words, 7 minutes read time.

We have built our enterprise security perimeters on a foundation of sand, and the storm has finally arrived. For years, security leadership assured stakeholders that multi-factor authentication was the ultimate shield against unauthorized entry. That comfort was a lie, born of complacency and soft thinking. Threat actors have evolved past simple credential harvesting; they are actively deploying Adversary-in-the-Middle (AiTM) phishing frameworks and zero-visibility QR code vectors that bypass legacy defenses without breaking a single line of code. We watched the systems fail because we relied on passive compliance rather than uncompromising operational discipline.

The modern attack landscape does not care about our corporate policy manuals or annual security awareness videos. According to data tracked by Microsoft Threat Intelligence and the Cybersecurity and Infrastructure Security Agency (CISA), targeted organizations face an unprecedented surge in AiTM token hijacking and image-embedded QR phishing campaigns designed specifically to bypass secure email gateways. Threat actors set up reverse-proxy infrastructure that sits directly between our users and legitimate authentication endpoints. When our workforce logs in, the attacker proxies the request, steals the authenticated session cookie in real time, and walks straight through the front door.

We must strip away the illusion that traditional defensive controls are keeping us safe. The rise of hybrid voice-and-email callback attacks and CAPTCHA-gated phishing infrastructure proves that attackers are exploiting the exact gaps we left open through institutional laziness. This deep-dive analysis confronts the mechanical realities of modern social engineering, dissects the failure of static multi-factor authentication, and lays out the hard architecture required to survive.

The Mechanics of Session Hijacking: How Reverse Proxies Bypass Legacy MFA

We need to understand the structural failure occurring at the authentication layer. Legacy multi-factor authentication relies on push notifications, SMS codes, or time-based one-time passwords (TOTP) to verify identity. Threat actors bypass these controls entirely by utilizing advanced AiTM phishing proxies like EvilGinx. The attack vector does not attempt to break encryption algorithms or crack complex passwords; it simply manipulates the human operating the endpoint into handing over full access.

The process is surgically precise and brutally efficient. An employee receives a high-urgency communication, often mimicking internal human resources or critical SaaS infrastructure. The link inside routes the target to an attacker-controlled proxy server that dynamically mirrors the organization’s real login portal in real time. As the employee inputs their primary credentials and completes the secondary MFA challenge, the proxy server relays those packets directly to the legitimate service provider.

Once the service provider authenticates the session, it issues a session token or authentication cookie back to the user. Because that traffic flows directly through the adversary’s proxy, the attacker captures the live session token instantaneously. The attacker then injects that session token into their own browser, instantly hijacking the active, fully authenticated corporate session without ever needing to know the user’s password or possess their physical MFA token. We must realize that the authentication process completed successfully in the eyes of the server, yet the enterprise was compromised entirely.

Blind Spots in the Perimeter: The Rise of Image-Based Quishing and TOAD Attacks

We have allowed our perimeter defenses to become completely blind to non-traditional attack vectors. Standard secure email gateways spend massive compute resources scanning incoming plain-text URLs and parsing standard attachments for known malicious signatures. Cybercriminals recognize this dependency and have adapted by shifting their payloads into optical and multi-channel vectors that bypass automated text-scanning engines entirely.

QR code phishing, known colloquially as quishing, represents a massive operational vulnerability across corporate environments. Attackers embed malicious authentication URLs inside image-based QR codes wrapped within benign PDF documents or inline email bodies. Traditional email filters read the image as harmless static graphic data, allowing the message to land directly in the victim’s inbox. The target is instructed to scan the code using a personal mobile device to complete an mandatory system update or open a secure document.

This action immediately forces the target off our managed corporate network and onto an unmonitored mobile device that lacks endpoint detection and response (EDR) agents. From there, the mobile browser connects to the AiTM proxy framework, and the session is compromised out of sight of internal security operations. Simultaneously, Telephone-Oriented Attack Delivery (TOAD) campaigns combine fake subscription invoices with live callback centers. When employees call the listed support number, live operators leverage high-urgency social engineering to guide targets through manual credential entry or remote control software installation. The system fails because we trained our people to look for suspicious links while leaving them exposed to visual and verbal exploitation.

Engineering Absolute Resistance: Deploying FIDO2 and Zero-Trust Architecture

We cannot solve an architectural flaw with soft solutions like additional compliance training or stern warning banners. Human error under psychological manipulation is an inevitable reality; therefore, our technical controls must enforce absolute resistance at the protocol level. We must eliminate push-based and TOTP-based authentication schemes in favor of hardware-bound, phishing-resistant credentials based on FIDO2 and WebAuthn standards.

FIDO2 architecture neutralizes AiTM reverse-proxy attacks through cryptographic origin binding. When an employee authenticates using a FIDO2 security key or platform authenticator, the web browser cryptographically binds the authentication request to the specific domain origin shown in the browser address bar. If an attacker routes the employee to a spoofed proxy domain, the browser detects the domain mismatch and refuses to sign the authentication challenge. The proxy captured nothing because no valid token was ever generated.

Beyond hardware-bound authentication, we must enforce strict Zero-Trust network access and continuous conditional access policies. Authentication must never be treated as a single, static event that grants permanent access for the duration of a session token. System infrastructure must continuously evaluate device health, geographic velocity, IP reputation, and behavioral anomalies throughout the entire life of the connection. If a session token suddenly presents from an unrecognized IP address or an unmanaged device, that session must be revoked immediately, and step-up authentication must be enforced.

Summary of Core Defenses

• Hardware-bound FIDO2 and WebAuthn protocols eliminate AiTM session hijacking by cryptographically binding authentication challenges to verified domain origins.
• Optical payload inspection and mobile device management controls counter image-based quishing vectors that bypass traditional secure email gateways.
• Continuous conditional access policies validate device compliance, network context, and session integrity in real time to neutralize stolen session tokens.

The era of trusting simple passwords paired with basic multi-factor push notifications is dead. Attackers have weaponized automated proxies and optical vectors to turn our own authentication mechanisms against us. Survival requires dropping the comfortable illusion of legacy security, taking absolute accountability for our technical debt, and building an unyielding architecture that stops threat actors cold before the system burns.

D. Bryan King

Sources

• CISA: Defending Against Software Supply Chain Attacks & Phishing Proxies
• Microsoft Security: From Cookie Theft to BEC: Adversary-in-the-Middle Phishing
• MITRE ATT&CK: Steal Web Session Cookie (Technique T1539)
• NIST National Vulnerability Database: Session Hijacking & Token Exploits
• FIDO Alliance: FIDO2 Authentication Standards & Specifications
• W3C: Web Authentication (WebAuthn) Specification
• FBI Internet Crime Complaint Center (IC3): Public Service Announcement on Quishing Trends
• SANS Institute: Combatting Adversary-in-the-Middle (AiTM) Phishing Attacks
• NIST Special Publication 800-63-3: Digital Identity Guidelines
• Mandiant: Dissecting Adversary-in-the-Middle Infrastructure
• BleepingComputer: Microsoft Warns of Massive AiTM Phishing Campaigns
• Krebs on Security: Microsoft on AiTM Phishing Attacks That Bypass MFA
• Dark Reading: Quishing on the Rise: How QR Code Attacks Bypass Defenses
• SecurityWeek: QR Code Phishing Trends Targeting Corporate Enterprise Networks
• Infosecurity Magazine: MFA Bypass and Session Token Hijacking Surge
• CrowdStrike: What is an Adversary-in-the-Middle (AiTM) Attack?
• Palo Alto Networks: Understanding AiTM Phishing Frameworks and Reverse Proxies
• Trend Micro: Adversary-in-the-Middle Phishing Attacks Explained
• Fortinet: What is Quishing? Understanding QR Code Phishing Threats
• Proofpoint: Telephone-Oriented Attack Delivery (TOAD) Threat Insight
• Rapid7: Understanding Session Hijacking and Pass-the-Cookie Attacks
• Check Point Software: Comprehensive Guide to Quishing and EvilGinx Exploits
• Sophos: Technical Report on Modern MFA Bypass Techniques
• SentinelOne: Session Cookie Theft: How Attackers Bypass MFA
• ThreatDown: QR Code Phishing (Quishing) Mechanics Explained
• Schneier on Security: Analysis of MFA Bypasses via Reverse Proxies
• ZDNET: QR Code Phishing as a Growing Enterprise Security Threat
• The Hacker News: Analysis of EvilGinx3 Phishing Framework Capabilities
• CNET: Quishing: How Scammers Use QR Codes to Steal Credentials
• Aruba Networks: Fundamentals of Zero Trust Network Access (ZTNA) Architecture

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

Why AI Agents Must Be Treated Like Security Principals https://youtu.be/J2qgGKopHPM #ArtificialIntelligence #Cybersecurity #AIAgents #IdentitySecurity #IAM #ZeroTrust #AgenticAI #AIGovernance #AIsecurity #CyberRisk #LeastPrivilege #AccessControl #DigitalIdentity #MachineIdentity

I'm Nashville-bound next week for the Hybrid Identity Protection Conference!

Focusing on:
🛡️ Defending AD
🛑 Retiring NTLM
☁️ Securing Entra
(w/ @horse, @ericonidentity, @merill, and others!)

Staying ahead of identity threats is how I keep clients secure. Attending? Drop a reply to connect!

#HIPConf #InfoSec #CyberSecurity #ActiveDirectory #EntraID #IdentitySecurity

A stolen identity can sometimes be more useful to an attacker than sophisticated malware.

Phishing-resistant authentication such as passkeys and FIDO-based methods can make credential-stealing attacks significantly harder.

Modern security is therefore moving beyond one question:

Identity has effectively become a new security perimeter.

https://thenewsink.com/identity-security-explained/

#IdentitySecurity #Cybersecurity #MFA #Passkeys #ZeroTrust #TheNewsInk

New by me: CybersecKyle Security How-To Series: Light Offensive to Think Defensively, Part 3 - Recon and Password Attack Theory Inside the Lab

https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-light-offensive-to-think-defensively-part-3-recon-and-password-attack-theory-inside-the-lab/

#Cybersecurity #InfoSec #Passwords #IdentitySecurity #CybersecKyleHowTo

We’ve published three new #midPoint maintenance releases! 🎉 MidPoint 4.8.13, 4.9.8, and 4.10.4 bring security, stability, and miscellaneous bug fixes.

Learn more:
👉 4.8.13: https://docs.evolveum.com/midpoint/release/4.8.13/
👉 4.9.8: https://docs.evolveum.com/midpoint/release/4.9.8/
👉 4.10.4: https://docs.evolveum.com/midpoint/release/4.10.4/

#opensourceIGA #identitysecurity #opensource

New by me: CybersecKyle Security How-To Series: Light Offensive to Think Defensively, Part 2 - Phishing Simulation to Study Prompts and Controls

https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-light-offensive-to-think-defensively-part-2-phishing-simulation-to-study-prompts-and-controls/

#Cybersecurity #InfoSec #Phishing #IdentitySecurity #CybersecKyleHowTo

Losing your phone is no longer just an annoyance.
Read the blog: https://marshsecurity.org/protecting-against-lost-stolen-mobile-microsoft-security/

Losing your phone when it contains access to your email, Microsoft 365, MFA, corporate data, personal accounts, banking, photos and potentially your entire digital identity is a little more serious than "annoyance".

I’ve published a new post looking at what you can do to reduce the impact of a lost or stolen mobile device, both from a personal perspective and also within a business. This blog covers some of the practical protections available through Microsoft and modern device management, as well as the steps worth taking before a device disappears.

Because realistically, the best time to think about how you’d respond to a lost phone probably isn’t five minutes after realising it’s no longer in your pocket.

Read the blog: https://marshsecurity.org/protecting-against-lost-stolen-mobile-microsoft-security/

Tags:
#Microsoft #Security #Cyber #Tech #Technology #CyberSecurity #MicrosoftSecurity #MicrosoftIntune #Intune #Microsoft365 #EntraID #IdentitySecurity #MobileSecurity #InformationSecurity #DataProtection

🎙️ On the Nexus Podcast, ClearVector Founder & CEO John Laliberte explores one of today's fastest-growing cybersecurity challenges: non-human identities (NHIs) and the role AI agents play in creating and managing machine identities across enterprise and critical infrastructure environments.

Learn why identity visibility, detection, and governance are essential for reducing cyber risk as AI adoption accelerates.

🎧 Listen to the full episode: https://nexusconnect.io/podcasts/nexus-podcast-john-laliberte-on-ai-and-non-human-identity-controls

#Cybersecurity #AI #IdentitySecurity #NonHumanIdentities #CriticalInfrastructure #MachineIdentity

Admin Console 17.10.2 builds upon features introduced in 17.9.0 and 17.10.0.

- Admins can configure approval workflows for AI-related request types introduced with the Agentic AI Governance feature for Keeper Endpoint Privilege Manager.
- Admins can directly view Non-Human Identity UIDs, including specific app UIDs for Keeper Secrets Manager devices.
- New event types for Advanced Reporting and Alerts Module include Revealed Password, Moved Folder, Updated Folder and Moved Record.

#KeeperSecurity #IdentitySecurity #CybersecurityTools

🔐 Zero Trust needs more than authentication — it needs enforcement.

How can mTLS, JWT validation, identity-based routing, and Layer 7 micro-segmentation work together to make Zero Trust practical?

Our latest technical guide explores how to implement these principles directly at the application delivery layer with RELIANOID.

👉 Read the full technical guide and discover how to turn your ADC into a Zero Trust enforcement point.

#ZeroTrust #Cybersecurity #mTLS #IdentitySecurity

If AI can imitate voices, generate realistic faces, automate phishing campaigns, and manipulate human trust, should boards continue measuring security maturity by MFA adoption alone?
Or is it time to redefine identity assurance as a strategic business capability rather than another cybersecurity control?
#Leadership #CyberSecurity #ArtificialIntelligence #IdentitySecurity #DigitalTrust
https://stayingalive.in/cataloguing-strategic-innov/biometric-assured-identity.html

#TechnicalTalk
Adversary Village at @defcon 34!
Samet Can Tasci, Senior Linux Systems Engineer, and Mehmet Önder Key, Cyber Security Consultant, are speaking on “Emulating the Identity-First Threat Actor: Automated Playbooks for IdP Hijacking” on 8 Aug 2026 at DEF CON Creator Stage 3.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session and speakers: https://adversaryvillage.org/adversary-events/DEFCON-34/Samet-Can-Tasci
https://adversaryvillage.org/adversary-events/DEFCON-34/Mehmet-%C3%96nder-Key
#AdversaryVillage #DEFCON34
#TechnicalTalk #IdentitySecurity #ThreatActors #IdPHijacking
#RedTeam #AdversaryEmulation

New by me: CybersecKyle Security How-To Series: Power User and Small Team, Part 1 - Account Inventory and Least Privilege

https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-power-user-and-small-team-part-1-account-inventory-and-least-privilege/

#Cybersecurity #InfoSec #IdentitySecurity #SmallBusiness #CybersecKyleHowTo

🔐 Zero Trust isn’t just about identity — it’s about where identity is enforced.

In hybrid and multi-cloud environments, security breaks when identity stops at login and doesn’t control traffic flow.

Our latest article explores why the application delivery layer is becoming the new Zero Trust enforcement point — and how identity-aware traffic control changes everything.

🔗 Read more 👇
https://www.relianoid.com/blog/zero-trust-in-hybrid-environments-why-identity-must-control-the-traffic-layer/

#ZeroTrust #CyberSecurity #HybridCloud #IdentitySecurity #DevSecOps #RELIANOID

Hello #FediVerse
Do you use ID.me ? Please leave a comment if you have opinions, thoughts or concerns about their service. Thank you.

#Identity #IdentitySecurity #OnlineSafety

🚨 New integration: Keeper Security and Wiz

Our new integration connects Wiz's cloud vulnerability discovery directly to KeeperPAM, automatically rotating compromised credentials and enforcing least privilege – across human users, machine identities, AI agents and database accounts – the moment a risk is found.

#KeeperSecurity #Wiz #CloudSecurity #PrivilegedAccessManagement #IdentitySecurity

New by me: Passkeys Are Better Than Passwords, but They Are Not a Silver Bullet

https://www.kylereddoch.me/blog/passkeys-are-better-than-passwords-but-they-are-not-a-silver-bullet/

#Cybersecurity #InfoSec #Passkeys #IdentitySecurity #MFA

SASE and Zero Trust set the stage for safer cloud work. What path will you take? #SASE #ZeroTrust #CIO #NetworkSecurity #CyberSecurity #CloudSecurity #EnterpriseIT #DigitalTrust #IdentitySecurity
https://www.linkedin.com/pulse/sase-zero-trust-networks-new-nerve-system-modern-cios-mohindroo--b7x0c

🟦 Entra Tenant Governance | Find Configuration Drift

New preview lets admins detect tenant configuration drift natively across Entra and related services. 🔹

Define JSON baselines as configuration as code and create scheduled monitors. Monitors run every six hours and produce run summaries and detailed drift objects with property level diffs. Govern external tenants via B2B signals and role based templates from a single admin center. 💡

💡 Configuration as code baseline
🔍 Six hour monitor interval
⚖️ Cross tenant governance via B2B signals

▶︎ https://www.hubsite365.com/en-ww/pro-office-365/?id=78675908-1859-f111-bec7-7c1e5273f078&topic=eb4ea787-ac86-ec11-93b0-6045bd8f31a1&theater=true

#MICROSOFTENTRA #IDENTITYSECURITY #ZEROTRUST #CLOUDSECURITY