- Attacker is targeting a user of
bank.comuses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form.
- Attacker registers domain name
- Attacker creates a web page that scrapes the login page of
bank.comand presents it from the domain
baank.com(or working as a MITM proxy to send user supplied details back to
- Attacker sends a phishing email to the user getting them to log in to
- User fills in their username, password, and 2FA (as per usual).
- Attacker now has the users credentials as well the 2FA that the user supplied.
- Attacker immediately (maybe through a script) logs in to the bank account since he has the username, pass, and 2FA.
Am I missing something or does user-entered 2FA not help in this scenario?