. home.aspx



Phishing Attacks Bypass Two-Factor Authentication

January 10, 2019 / Kacy Zurkus

Using a new penetration testing tool to automate phishing attacks, hackers can potentially bypass two-factor authentication (2FA), according to a new post published by security researcher Piotr Duszynski. The tool was written to intentionally make phishing campaigns as easy and effective as possible, said Duszynski. Dubbed Modlishka, a Polish word that means "mantis," the tool can reportedly bypass login operations for accounts protected by 2FA and enable an attacker to have full control of "cross" origin TLS traffic flow from the victims browsers, Duszynski wrote. A GitHub user inquired whether the 2FA is broken, to which Duszynski explained, “2FA isn't broken. At the end it is all about 'social engineering' that you will have to be stay alert about. Which can be e-mail, phone, post or face2face based. “If you don't want to always verify if the domain name in the URL address bar of your browser isn't somehow malicious or worry if the...