How to Bypass 2FA/MFA with Phishing

In this article, we will discuss how you can bypass Multi-Factor Authentication (MFA) in a Phishing attack, to takeover accounts.

Pre-requirements

• A good domain to be used. You can also take a look over the repository I’ve put together with some available domains that you can purchase and use for your phishing engagements. You can find the link below.

GitHub - corneacristian/phishing-domains: A list of Available Domains for Phishing Tests

• Evilginx2 is installed on your public machine. We will be using this tool in order to act as a Man-in-the-Middle (MitM) between the victim and the official platform we are phishing for (O365, AWS, LinkedIn, and so on).

GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login…

Creating Phishing Page

Once installed on our machine, we will start Evilginx2 in testing mode using the -developer flag, as shown below.