Skip to main content

VNCPhish: How Hackers Pwn Users Despite MFA

25-minute Talk

Don’t let MFA lull you into a false sense of security. A sophisticated attacker can still trick users and gain access to sensitive corporate accounts.

Deep Dive session

Timetable

10:45 a.m. – 11:30 a.m. Wednesday 26th

Room

Room D5 - Track 8: Security Testing Deep Dive

Security Testing

Audience

Anyone interested in offensive security testing.

Key-Learnings

  • Learn how attackers bypass MFA prompts in order to take over your login sessions.
  • Understand how you can defend against such MFA phishing attacks.

“Oh, our application is protected against phishing: we have Multi-Factor Authentication (MFA) enabled. An attacker can’t do anything with stolen credentials.” I’ve heard this sentiment more than once when speaking to customers, and they are right—to an extent. Classic phishing attacks are prevented with MFA enforcement. 

However, security is a cat and mouse game, and attackers are always evolving. Methods have already been developed to successfully phish users despite the use of MFA. As a red teamer who carries out offensive security testing assessments, I can confirm that this technique works. In fact, it has never failed us.

The good news is that this attack can be prevented. Want to know how?

Related Sessions

Deep Dive session
Tue, Nov 25 • 2:45 p.m. – 4:45 p.m.
Room D5 - Track 8: Security Testing Deep Dive

120-minute Workshop

Security Testing

Deep Dive session
Wed, Nov 26 • 11:45 a.m. – 12:30 p.m.
Room D5 - Track 8: Security Testing Deep Dive

25-minute Talk

Continuous Integration/Continuous Delivery (CI/CD) Security Testing Test Automation

Deep Dive session
Wed, Nov 26 • 2:45 p.m. – 4:45 p.m.
Room D5 - Track 8: Security Testing Deep Dive

120-minute Workshop

Other Security Testing

Deep Dive session
Thu, Nov 27 • 2:45 p.m. – 4:45 p.m.
Room D5 - Track 8: Security Testing Deep Dive

120-minute Workshop

Other Security Testing