skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-adversary-in-the-middle-phishing-detection

Detect and respond to AiTM phishing attacks that bypass MFA via reverse-proxy session theft.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#phishing detection#conditional access#session hijacking#MFA bypass#aitm#evilginx
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-adversary-in-the-middle-phishing-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-adversary-in-the-middle-phishing-detection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/phishing-defense/performing-adversary-in-the-middle-phishing-detection
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-adversary-in-the-middle-phishing-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adversary-in-the-Middle phishing kits like EvilProxy, Evilginx, and Tycoon 2FA relay real logins through reverse proxies, so MFA succeeds while attackers steal session cookies. This Skill provides detection rules, hardening steps, and validation procedures to identify and stop these MFA-bypass attacks.

Core Features & Use Cases

  • Phishing-Resistant MFA Deployment: Guides rollout of FIDO2, Windows Hello, and certificate-based authentication that AiTM proxies cannot intercept.
  • Detection Rule Engineering: Builds SIEM alerts for session-cookie reuse from new IPs, impossible travel, inbox-rule creation, and OAuth consent after suspicious sign-ins.
  • Conditional Access Hardening: Configures token binding, continuous access evaluation, and anonymous-proxy blocking to defeat session replay.
  • Use Case: A security team investigating a Microsoft 365 account takeover uses this Skill to confirm an AiTM compromise, revoke the stolen session via CAE, and deploy FIDO2 keys for privileged users.

Quick Start

Analyze our Entra ID sign-in logs for AiTM phishing indicators and recommend Conditional Access policies to block session cookie replay.

Frequently Asked Questions about performing-adversary-in-the-middle-phishing-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect AiTM phishing attacks in Microsoft 365?▼

Detect AiTM attacks by alerting on session cookies used from a different IP, ASN, or device than the original authentication within minutes. Also monitor impossible travel, inbox-rule creation, and new MFA-method registration immediately after sign-in.

How does Evilginx bypass multi-factor authentication?▼

Evilginx acts as a reverse proxy between the victim and the real login service, relaying credentials and MFA challenges in real time. After the victim completes MFA, it captures the returned session cookie and replays it without needing MFA again.

Does FIDO2 protect against AiTM phishing attacks?▼

Yes, FIDO2 and WebAuthn resist AiTM attacks because authentication is cryptographically bound to the legitimate origin domain, so a proxied phishing page cannot complete the ceremony. SMS, voice, push, and OTP-based MFA remain interceptable.

What Conditional Access policies block session cookie replay?▼

Enable token binding, continuous access evaluation for real-time revocation, compliant-device requirements, and blocking of anonymous proxies and Tor exit nodes. Sign-in risk policies that force re-authentication on risky sign-ins also limit replayed sessions.

Why does a successful MFA sign-in not mean the user is legitimate?▼

AiTM kits relay the genuine login flow, so the identity provider records MFA as satisfied while the attacker harvests the session cookie in transit. The reliable signal is session usage from a different IP or device than the authentication event.

Related Skills

Explore More Software Engineering Skills→
riparinoriparino
1

defensive-log-analysis

Reference KQL log tables and retention policies for Sentinel deployments.

Community
Intermediate
webrix-aiwebrix-ai
1

incident-response-playbook-generator

Generate incident response playbooks for AWS, GCP, and Azure security incidents.

Official
Advanced
NousResearchNousResearch
239.1k

domain-intel

Perform passive OSINT reconnaissance on domains via subdomains, SSL, WHOIS, and DNS.

Official
Intermediate
AcczdyAcczdy
2

executing-phishing-simulation-campaign

Automate GoPhish phishing campaigns via REST API with metrics reporting.

Community
Advanced