Authentication Proxy Attacks: Detection, Response and Hunting

The talk examines reverse-proxy phishing kits that sit between a victim and a real login page, relay the multi-factor prompt, and capture the resulting session token. The speaker explains why a technique documented for years has become widely used by commodity cybercrime services, and how attackers have added redirect chains and filtering to slip past scanners. Delivery methods include abused encrypted-message portals that look trustworthy to recipients.

Detection depends on correlating weak signals, since impossible travel and new-IP logins are noisy when consumer VPNs and proxies are common. Useful signals include authentication method changes, new device registrations and mailbox rules created after a sign-in. For response, the talk stresses that a soft password reset does not invalidate a stolen session token in Azure, so a hard reset and token revocation are needed. Teams should also review conditional access policies, whose ordering mistakes can look correct on screen.

For hunting, the speaker suggests searching for lookalike authentication domains, default proxy-kit TLS fingerprints, Microsoft login page elements served from non-Microsoft sources, and corporate brand colors on unauthorized pages. He closes by urging defenders to run their own simulations, since a basic proxy setup can be launched in a Docker container, and to avoid placing the burden of spotting these attacks on users.