Two-Factor Authentication Is No Longer As Safe Thanks To This Cybersecurity Trick

For a while, it seemed like two-factor authentication was going to stump hackers for years to come. Its strength lies in giving you two distinct factors of authentication, mainly what you know and what you own. That is why when you enter a password (something you know) on a certain website, you're also asked to enter a code sent to your phone, tablet, or computer (something you own) in the form of a text message or push notification. It can also be something you are, like a fingerprint or facial scan. It is the second factor that presents a challenge for cybercriminals trying to hack you thousands of miles away, but now it seems they have found a way around it using a tool called Evilginx.

Once you log into a website using 2FA, you begin what's known as an authenticated session. Using Evilginx, they're hijacking the session cookies, which are temporary data files in your web browser that contain various information about the session, including the session ID of the successful login, to fool the website into thinking you're the one who has logged in. So all they have to do to bypass 2FA is wait for you to complete the login process, allowing them to steal your password and gain access to all your personal information stored on your site.

With normal phishing, the hacker creates a fake website that looks like a legit login portal for something you use. It can be the login page for a bank, cloud service, social media profile, or eCommerce site. The problem is that the 2FA code goes to your phone and requires extra steps to trick it out of you. So instead of doing that, they place Evilginx behind the fake login portal, letting it sit between you and the legit website. So, while you're entering your login credentials on the fake site, Evilginx is relaying that information to the real one and vice versa.

Once you authenticate the login, Evilginx grabs the session cookies and uses them to trick the website into letting the hackers access your real account. You never logged into the website — they did. Now they have access to everything as if they were you. All of what is happening here, including impersonating a legit website, relaying information, session hijacking, and then hacking your account, fits the definition of an adversary-in-the-middle (AitM) attack.

Launching AitM attacks was never the aim of Evilginx. It's actually an open-source tool used in cybersecurity for running phishing simulations that expose weak multi-factor authentication through session hijacking so that the data can be used to strengthen security. But due to its open-source nature, hackers have modified it to achieve their nefarious means.

Many websites are using passkeys and security keys, and it's for good reason. Passkeys allow you to log in to websites without a password by using your phone, tablet, or computer's on-device authentication method, such as fingerprint scanning or facial recognition. You can also use a security key like YubiKey, which works in the same way as a passkey, but it's a USB stick instead that you insert to authenticate your access.

The best part is that these authentication methods are tied to your devices. So even if the hackers hijack your session, the website will know it's not you and deny them access. In fact, if you notice that Evilginx is in play, sign out of all your sessions and log back in using a passkey or security key. Other than that, be sure to follow the best practices for staying safe online. For one, don't click on suspicious links. When in doubt, scan the link on VirusTotal to find out if it's harmful.

You should also use an antivirus that offers real-time protection and can detect and block harmful websites (like Microsoft Defender's SmartScreen does). Avoid reusing passwords and use a password manager to generate and autofill passwords. Since these passwords are autofilled on the exact website they were created on, they can't be tricked by a fake URL. Doing all this, not just one, will allow you to get ahead of these scammers using Evilginx for nefarious means.