MFA doesn't stop all attackers. Evil Twin proves this.

What an internship research project teaches us about modern phishing

Multi-factor authentication is an important layer of security. And rightly so it prevents a large proportion of attacks that rely solely on compromised passwords. But MFA does not automatically make an account impenetrable.

Jules, an intern on our Offensive Security team, investigated an attack technique that targets not the password, but the user’s trust. The goal: to better understand how modern phishing attacks work and how organizations can protect themselves against them.

What is an Evil Twin attack?

An attacker sets up a fake Wi-Fi network with the same name as an existing network. If a user connects to it, the attacker can intercept the traffic and redirect the user to a fake login page without the user noticing.

In a controlled test environment, Jules combined this technique with Evilginx, an open-source framework for simulating phishing attacks. The focus was not on the attack itself, but on the question: What risks arise here, and how can you protect your organization against them?

What this study shows

MFA remains an important security measure. However, it does not eliminate all risks. If a user is tricked, attackers can exploit existing sessions in certain situations.

Key insights:

• Strong passwords and MFA remain essential, but they are not the only line of defense.
• User awareness remains a factor you can’t ignore.
• Phishing-resistant authentication, such as FIDO2 and passkeys, provides additional protection.
• Security isn’t just about technology. It’s also about behavior and making the right choices.

Why we are investigating this

Cyber threats are constantly evolving. That’s why we research new techniques and translate what we learn into practical advice, not to simulate attacks for the sake of attacking, but to help organizations identify where the risks lie and how to mitigate them.

At SUPERP, we believe in IT that really works. No complicated jargon or one-size-fits-all solutions. Practical security that helps organizations move forward.

Want to know more?

Curious about how your organization handles modern phishing attacks? Or would you like to discuss phishing-resistant authentication?

We’re happy to help you find a solution.