The cybercrime landscape has fundamentally transformed. Phishing-as-a-Service (PhaaS) platforms now enable non-technical criminals to launch sophisticated credential-stealing campaigns for approximately $150 monthly. These subscription services include pixel-perfect login page clones, hosting infrastructure, and dashboards for monitoring captured credentials. Advanced variants like EvilProxy function as adversary-in-the-middle proxies, bypassing standard multi-factor authentication by intercepting and forwarding authentication sessions in real time.
What Is Phishing-as-a-Service?
PhaaS represents a subscription-based criminal offering providing everything an attacker needs to run a phishing campaign. Services include phishing page templates mimicking Microsoft 365 logins, banking portals, and DocuSign interfaces, plus hosting infrastructure with domain rotation capabilities. The most sophisticated platforms operate as adversary-in-the-middle proxies, intercepting MFA exchanges between users and legitimate services.
How AiTM Phishing Bypasses MFA
Standard MFA relies on a second authentication factor — typically app notifications or SMS codes — following password entry. AiTM attacks circumvent this by positioning a reverse proxy between the victim and the legitimate server. The attack sequence unfolds as follows:
- Victims receive convincing phishing emails and click links appearing to be legitimate login pages.
- The fake page functions as a reverse proxy between victim and the actual login server, forwarding all interactions in real time.
- When victims enter passwords, these credentials route to Microsoft's legitimate servers, triggering MFA prompts.
- Victims complete MFA challenges on their devices; the proxy intercepts the resulting authenticated session cookie.
- Attackers leverage captured session cookies to access accounts, completely circumventing MFA protections.
Why Email Filters Alone Are Not Enough
PhaaS kits evade detection through frequent domain rotation, legitimate cloud infrastructure utilisation, and links routed through legitimate redirectors and URL shorteners. Many incorporate bot-detection capabilities, displaying phishing pages to humans while presenting harmless decoy pages to security scanners. Emails from PhaaS campaigns frequently land in inboxes even with Microsoft Defender for Office 365 or Proofpoint in place. Email authentication protocols verify sending domains but cannot evaluate content intent or detect AiTM proxy sites.
Defences That Actually Work
Phishing-Resistant MFA (FIDO2 / Passkeys)
FIDO2 authentication binds to specific origin domains. When users attempt authentication on phishing proxy sites, FIDO2 keys fail recognition — the domain authentication becomes invalid for non-legitimate origins. This is the only form of MFA that is genuinely immune to AiTM attacks.
Conditional Access Policies
Even when attackers capture session tokens, Conditional Access policies in Microsoft Entra ID restrict token utility. Policies requiring compliant device sign-in, geographic restrictions (Australian access only), or business-hours-only authentication narrow exploitation windows. Token protection directly addresses session token theft by binding tokens to specific devices.
Security Awareness Training
Simulated phishing campaigns testing employee responses — rather than passive video training — measurably reduce click rates over time. Platforms like KnowBe4 or Microsoft Attack Simulator deploy realistic phishing emails, track clicks, and provide immediate training to vulnerable employees, building scepticism as operational practice rather than policy compliance.
Key Takeaways
- PhaaS platforms enable non-technical criminals to execute sophisticated phishing campaigns through monthly subscriptions.
- AiTM proxy kits like EvilProxy bypass standard app-based MFA by stealing session cookies in real time.
- Email filters cannot reliably detect PhaaS-generated emails; technical controls and human training must function together.
- FIDO2/passkeys represent the only MFA method immune to AiTM attacks; Conditional Access provides critical supplementary protection.