How fake login pages get past two-step login
A fake page on a domain like yourcompany-login.com can pass your login to the real site as you type, code included, and keep the session the real site hands back. The criminal then uses that session with no code needed. This is an adversary-in-the-middle (AiTM) attack. We find the lookalike it runs on and get it taken down.
What two-step login protects, and where it stops
Two-step login (MFA) adds a second check when someone logs in. After that, the site gives the browser a session cookie, and whoever holds that cookie is logged in.
What two-step login does well
- Stops logins with a reused or leaked password
- Blocks most automated password guessing
- Adds a check that a plain fake page cannot get past
What it cannot do
- Protect the session cookie once the login has finished
- Tell a relay page from a real user when codes or app prompts are used
- Warn anyone that a lookalike of your domain is being set up
- Get a fake page taken down
We watch the web addresses a relay page has to run on, so the page is found and reported whichever second step your people use.
The attack
Your customer
Opens yourcompany-login.com
Types password and code
Criminal’s relay page
Fake site with a valid padlock
Passed on
Your real site
yourcompany.com sees a normal login
Password, two-step code and login session taken
What we do
DefendDomain alert
Lookalike, new certificate or relayed login page
You confirm
Evidence sent
Registrar, host and browser warning lists
They act
Your customer
Sees a browser warning, then the site goes offline
We chase automatically until it is offline.
How a relay page takes a logged-in session
The set-up and the lure happen outside your systems, which is where we look. The domain and the certificate a relay page needs can both be flagged before the first link goes out.
What a stolen session leads to
A login that looks normal
The session really was logged in, so there are no failed logins to spot.
Payment requests from a real mailbox
With access to a real mailbox, the criminal can send payment requests from it. We cannot protect a hacked mailbox; we can find the relay page that led to it.
A hacked mailbox rather than a relay page, with the same ending. In our pharmaceuticals case, attackers used an employee’s email account to send a client fake payment instructions, and the client paid €150,000 into a bank account opened under a false name.
- Fake invoices
The company later brought in DefendDomain to watch for the lookalike domains and fake payment pages that can follow this kind of attack.
Read the case study: Lookalike monitoring after a €150,000 loss
What we watch for, and what happens next
A relay page runs on a web address, usually with a certificate, and passes your login page through. All three can be seen from outside your network.
When one is found
The alert carries a screenshot of the relayed page, who registered the domain and when, where it is hosted and the certificate it uses. When you confirm it is an attack, one click sends that evidence to up to 12 places at once: the registrar, the host and the email provider, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines. If a company does not act, we chase the registrar and host again at 48 and 96 hours, then the registry at 120 and 168 hours. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.
Found the same way
Not a relay page, but a copied website with a working padlock. In our consultancy case it was found by the certificate logs, a search for the company’s wording and the website marker, and one report with the evidence went to the hosting platform on the day the copy was confirmed.
- Copied website
Offline about 24 hours after the copy was confirmed.
Read the case study: Copied website removed in about a day
Two-step login and DefendDomain side by side
The two sit at different points: one on your login, one on the web addresses around it.
| Question | Two-step login |  DefendDomain |
|---|---|---|
| What it protects | Two-step login: The login step on your real site | DefendDomain: Nothing on your site. We watch the web addresses outside it |
| What it needs from you | Two-step login: Set up for every person and device | DefendDomain: Your domain names. The website marker on your login page is optional |
| Where the alerts go | Two-step login: Your sign-in logs | DefendDomain: Email, Slack, Microsoft Teams, SMS or webhook, or into Splunk, Microsoft Sentinel or Wazuh |
Questions about two-step login and relay pages
See the lookalikes that could host a relay page
In a 30-minute demo we show you the lookalikes of your domain that exist today and how the website marker works on a login page.
- Which lookalikes of your domain exist now, and which have a certificate
- How the website marker goes on your login page, if you want it
- A clear annual price for your domains
Rather see results first? Run a free scan