So Long, and Thanks for All the Phish
Analyzes the evolution of enterprise phishing defense and demonstrates novel reverse-proxy adversary-in-the-middle tradecraft to bypass modern authentication.
Summary
The Arms Race in Enterprise Phishing
As organizations deploy automated email filtering, domain reputation checks, and multi-factor authentication, phishing operators continuously adapt their delivery mechanisms and credential harvesting infrastructure.
Adversary-in-the-Middle (AiTM) Tradecraft
Harrison Sand and Erlend Leiknes demonstrate advanced AiTM proxy architectures that capture live session cookies and authentication tokens in real time, bypassing traditional SMS and app-based MFA.
Evasion of Modern Email Defense Platforms
Techniques for leveraging legitimate SaaS platforms, CAPTCHA obfuscation, and dynamic user-agent fingerprinting allow phishing kits to evade automated security sandbox analysis.
Implementing Phishing-Resistant Authentication
Effectively countering modern AiTM phishing attacks requires organizations to transition to FIDO2 WebAuthn passkeys, enforce device attestation, and deploy conditional access policies.
Related talks
Main Stage·43 min
Keanu Nys
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.
Creator Stage·18 min
Melvin Langvik
Explores QR code phishing tactics, visual obfuscation methods, and Outlook email rendering quirks used to evade modern email defenses.
War Stories·47 min
Jayson E. Street
Demonstrates how generative AI tools enhance phishing and vishing operations and outlines strategies to build organizational situational awareness.