State-of-the-art phishing: MFA bypass

Cisco Talos details how cybercriminals are conducting MFA bypasses using adversary‑in‑the‑middle reverse proxies and turnkey Phishing‑as‑a‑Service kits (Tycoon 2FA, Evilproxy/Evilginx), outlines common indicators (e.g., Evilginx default URL patterns, LetsEncrypt/TLS certificate metadata, anomalous session reuse), and recommends stronger defenses such as WebAuthn, MFA log auditing, and network/security controls to detect and prevent these campaigns.