How does Evilginx reverse proxy phishing work and why does it bypass two-factor protection?

A MALICIOUS SERVER INTERCEPTS SESSION COOKIES DIRECTLY DURING THE AUTHORIZATION PROCESS.

The attacker creates a mirror site that forwards requests to the real service and returns the response to the user in real time. At the moment of successful confirmation via SMS or an app, the utility intercepts the ready-to-use access token.

Intercepting Active User Sessions

Unlike classic phishing, Evilginx allows the victim to fully log into their profile and confirm entry with a one-time code. The proxy server saves the session cookie generated by the site, enabling the attacker to open the account in their own browser without re-entering passwords or 2FA keys.

Ways to Protect Against Advanced Interception

Switch to physical FIDO2 or WebAuthn hardware security keys
Use passkeys instead of traditional username, password, and one-time code combinations
Carefully check the domain name in the browser address bar before submitting confirmations
Terminate active sessions in all apps at the slightest suspicion of a compromise