Downgrade Attack Allows Phishing Kits to Bypass FIDO

Proofpoint researchers demonstrated a proof-of-concept phishing downgrade attack that uses the Evilginx AitM framework to spoof a victim's user agent and force Microsoft Entra ID to fall back from FIDO to weaker MFA methods, enabling attackers to harvest credentials and session tokens; the technique could be integrated into commercial phishing kits, though no real-world instances have been observed to date.