Reverse Proxy Phishing

What Is Reverse Proxy Phishing?

Reverse proxy phishing is a cyberattack in which an attacker places a malicious proxy between a user and a legitimate website to intercept authentication traffic. The proxy relays communication between the victim and the real service, allowing the attacker to capture login credentials, multi-factor authentication (MFA) responses, and session cookies.

Unlike conventional phishing, which typically collects credentials through a fake login page, reverse proxy phishing can relay the legitimate authentication process in real time. This allows attackers to capture an authenticated session even when the victim successfully completes MFA.

The technique is also known as adversary-in-the-middle (AiTM) phishing. Its primary objective is often account takeover through session theft rather than password collection alone.

How Does Reverse Proxy Phishing Work?

Reverse proxy phishing typically follows these steps:

1. Phishing Lure: The attacker sends a deceptive email, message, or link directing the victim to a fraudulent login domain that resembles a legitimate service.

‍2. Traffic Interception: The victim opens the link and interacts with an attacker-controlled proxy that forwards requests to the genuine authentication service.

3. Credential Capture: The victim enters their username and password. The proxy relays these credentials to the legitimate service while capturing them.

4. MFA Relay: If the service requests MFA, the proxy forwards the challenge to the victim and relays the response back to the real service.

5. Session Cookie Theft: After successful authentication, the service issues a session cookie or token. The attacker captures the session material as it passes through the proxy.

6. Account Takeover: The attacker reuses the captured session to access the victim's account, potentially without repeating the original login or MFA challenge.

Why Is Reverse Proxy Phishing Dangerous?

Reverse proxy phishing can undermine authentication controls by exploiting the way web sessions are established and trusted.

Key risks include:

• MFA Bypass: Attackers relay authentication challenges in real time and capture the resulting authenticated session.
• Account Takeover: Stolen session cookies or tokens can allow unauthorized access to email, cloud platforms, and business applications.
• Sensitive Data Exposure: Compromised accounts may expose confidential documents, customer information, and internal communications.
• Privilege Abuse: Attackers may use compromised administrator accounts to change security settings or access additional systems.
• Business Email Compromise: Access to a victim's mailbox can support fraudulent payment requests, impersonation, and further phishing campaigns.
• Persistent Unauthorized Access: If active sessions or refresh tokens remain valid, attackers may retain access until the relevant credentials, sessions, or tokens are invalidated.

What Is the Difference Between Reverse Proxy Phishing and a Legitimate Reverse Proxy?

A reverse proxy is a legitimate infrastructure component that receives requests from clients and forwards them to backend servers. Organizations use reverse proxies for load balancing, caching, TLS termination, application protection, and traffic management.

Reverse proxy phishing abuses the same intermediary concept for malicious purposes.

The presence of a reverse proxy does not indicate malicious activity. The risk depends on its ownership, configuration, and behavior.

How Is Reverse Proxy Phishing Different From Traditional Phishing?

Traditional phishing often directs users to a counterfeit login page that collects credentials for later use. Reverse proxy phishing relays traffic between the victim and the legitimate service, potentially capturing credentials and session cookies during the authentication process.

This real-time relay makes reverse proxy phishing particularly effective against MFA methods that rely on one-time codes or approval prompts. However, phishing-resistant authentication can substantially reduce this risk.

How Can Organizations Prevent Reverse Proxy Phishing?

Organizations should combine phishing-resistant authentication, identity monitoring, secure session management, and user awareness to reduce the risk of reverse proxy phishing.

• Use Phishing-Resistant MFA: Implement FIDO2 security keys or passkeys with origin-bound authentication where supported. These methods help prevent credentials and authentication responses from being relayed to an attacker-controlled domain.
• Enforce Conditional Access: Evaluate device compliance, user risk, sign-in context, and other available signals before granting access to sensitive applications.
• Monitor Authentication Activity: Detect suspicious sign-ins, unusual session behavior, unfamiliar devices, and unexpected changes in location or access patterns.
• Protect Session Tokens: Apply appropriate session expiration, reauthentication, and token protection controls. Where supported, use device-bound sessions or sender-constrained tokens.
• Deploy Email and Web Protection: Filter malicious messages, block known phishing domains, and detect suspicious redirects and lookalike login pages.
• Educate Employees: Train users to verify login domains, recognize suspicious authentication requests, and report unexpected MFA prompts.
• Prepare an Incident Response Process: Revoke compromised sessions, invalidate refresh tokens where applicable, reset affected credentials, and investigate potentially compromised accounts.

No single control eliminates every phishing risk. Organizations should regularly test authentication workflows and review identity security policies to address evolving attack techniques.

How Can Organizations Detect Reverse Proxy Phishing?

Detection requires correlating identity-provider activity with endpoint, network, and threat intelligence signals. Because the victim may successfully authenticate to the legitimate service, a successful login alone does not establish that the session is safe.

Security teams should monitor for:

• Authentication followed by unusual session activity or sensitive account actions.
• Sign-ins from unfamiliar devices or unexpected network locations.
• Suspicious domains that imitate legitimate identity providers.
• Unusual changes in session context or rapid activity inconsistent with normal user behavior.
• Multiple indicators of account compromise, such as unexpected mailbox rules, permission changes, or access to sensitive resources.

When compromise is suspected, security teams should investigate the session, revoke active sessions and refresh tokens as appropriate, and review subsequent account activity.

FAQs

Q1. What Is Reverse Proxy Phishing?

Reverse proxy phishing is an attack that places a malicious intermediary between a user and a legitimate website. It relays the authentication process in real time, allowing attackers to capture credentials, MFA responses, and session cookies that may enable unauthorized account access.

Q2. Does Reverse Proxy Phishing Bypass MFA?

Reverse proxy phishing can bypass some MFA methods by relaying authentication challenges and capturing the resulting session. Phishing-resistant methods such as properly implemented FIDO2 security keys and passkeys offer stronger protection because authentication is bound to the legitimate website's origin.

Q3. What Is Adversary-in-the-Middle Phishing?

Adversary-in-the-middle phishing is an attack in which an attacker intercepts and relays communication between a victim and a legitimate service. Reverse proxy phishing is a common implementation that can capture credentials and authenticated sessions during a live login process.

Q4. Can Reverse Proxy Phishing Steal Session Cookies?

Yes. A malicious reverse proxy can capture session cookies or other authentication tokens exchanged during a relayed login. Attackers may reuse this session material to access an account without repeating the original authentication process, depending on the service's session protections.

Q5. What Is the Difference Between Reverse Proxy Phishing and Session Hijacking?

Reverse proxy phishing is a method of obtaining authentication information by relaying traffic between a user and a legitimate service. Session hijacking is the broader act of taking over an authenticated session, which can occur through reverse proxy phishing or other methods of session-token theft.

Q6. Are Legitimate Reverse Proxies Dangerous?

No. Legitimate reverse proxies are widely used to manage traffic, improve performance, and protect backend applications. Reverse proxy phishing occurs when attackers operate a malicious intermediary to intercept authentication traffic or steal session information.

Q7. How Can Users Recognize Reverse Proxy Phishing?

Users should verify website domains before signing in, avoid login links from unexpected messages, and report suspicious authentication requests. However, because reverse proxy phishing can relay authentic login pages, visual inspection alone may not reliably identify every attack.

Q8. How Should Organizations Respond to Reverse Proxy Phishing?

Organizations should revoke affected sessions, invalidate refresh tokens where applicable, reset compromised credentials, and investigate suspicious account activity. They should also review authentication logs, identify the initial phishing entry point, and strengthen controls to prevent recurrence.

Q9. Can Antivirus Software Prevent Reverse Proxy Phishing?

Antivirus software may detect related malicious files or activity, but it cannot reliably prevent every browser-based reverse proxy phishing attack. Organizations should combine email and web filtering, phishing-resistant authentication, identity monitoring, and session security controls.

Q10. What Is the Most Effective Defense Against Reverse Proxy Phishing?

Phishing-resistant authentication, particularly FIDO2-based security keys and passkeys correctly bound to the legitimate origin, is among the strongest defenses against credential and session relay attacks. Organizations should complement it with conditional access, session protection, monitoring, and incident response.