Researchers Upload Easier 2FA Phishing Method to Microsoft’s GitHub

Researchers have uploaded a proof on concept for a phishing attack that would bypass two-factor authentication while leaving the user unaware. The technique, which is currently public on Microsoft's GitHub, makes use of a Docker container and reverse proxy. The Muraena reverse proxy combines with a Docker-based tool called Necrobrowser for automating headless Chromium instances. Using Muraena, which is written in Go, attackers can configure their domain for a legitimate Let's Encrypt certificate. A web works as a reverse proxy and pulls regular 2FA resources from a legitimate site. The end result is that a user can visit a phishing site with a real certificate and enter their 2FA code with no warnings. The site will then save the session cookie and can pass it onto Necrobrowser, which can open thousands of Chromium instances to perform tasks like logging in and screenshotting emails, performing password resets or setting up mail forwarding. The Necrobrowser instances can even be used to phish social media contacts.

Old Techniques, New Usability

In general, the concept here is the same attackers have been using for many years. However, the efforts of Bettercap's Giuseppe Trotta and BeEF's Michele Orru to create Muraena and Necrobrowser mean you don't need advanced technical knowledge. They should also better prevent browsers from detecting the attacks. Many users believe they could spot a phishing attack if they saw it, but these tools show that they can be extremely convincing. 2FA clearly isn't a catch-all for security, though USB hardware tokens can help a lot in that regard. Without specialized hardware, users can protect their Google account with Password Alert, which detects fake Gmail login pages and tells users if they've entered their details on a non-official site.