Recommendations on mitigation of man-in-the-middle phishing attacks (evilginx2/Modlishka)

CERT Polska documents a rise in MitM proxy phishing (tools: Modlishka, Evilginx2) that transparently proxies real-site traffic to harvest logins, 2FA codes and session cookies — often using valid TLS certificates — and recommends mitigations (U2F/WebAuthn, modified e-mail 2FA, JS-based MITM detection, and trap subpages) while noting these defenses can be bypassed with sufficient attacker effort.