Phishing-proof MFA stops Reddit AiTM login path

Reddit’s February 2023 workforce phishing turned one employee login into limited internal access. Phishing-proof MFA 2.0 is built to kill that AiTM-class credential harvest at sign-in, not to rewind files already reached under a live session.

According to Reddit’s findings post on February 9, 2023, a sophisticated phishing campaign obtained one employee’s credentials, after which the attacker reached some internal documents and internal business information. Contemporaneous secondary reporting characterized that campaign as AiTM-class live capture of credentials and second-factor tokens; Reddit’s own post confirms sophisticated phishing and credential theft without naming 2FA-token capture. Phishing-proof MFA 2.0 closes the transferable-factor login path that pattern needs. Access already taken under a completed workforce session is residual containment. For the full attack-chain narrative, read the companion on legacymfa.sucks.

FAQ

Would phishing-proof MFA 2.0 have stopped the Reddit employee login harvest?

Yes. Phishing-proof MFA 2.0 would have stopped the Reddit February 2023 employee credential harvest at login. An adversary-in-the-middle attack is a live reverse-proxy login that can capture a password plus a typed or approved second factor and finish authentication as the victim. Reddit’s official disclosure establishes sophisticated phishing and one employee’s credentials; contemporaneous secondary reporting framed the same campaign as AiTM-class second-factor token capture in real time. Phishing-proof MFA 2.0 uses device-bound, origin-bound public-key signatures with no OTP, SMS code, email code, or push approval for a proxy to steal or replay. Closing that phishable login stops this path. Malware after a legitimate login is a harder, separate problem.

How is MFA 2.0 stronger than passkeys alone for Reddit-style AiTM phishing?

Passkeys and WebAuthn are phishing-resistant at the login ceremony: signatures are origin-bound, so a fake gateway should not complete a true hardware-backed assertion. MFA 2.0 is phishing-proof across the identity lifecycle, so registration, device onboarding, authorization, authentication, and decommissioning do not reintroduce a transferable secret an attacker can coach or relay. For a Reddit-style workforce AiTM path, the prevention win is the same at authentication: nothing useful leaves the enrolled device for the kit. The architecture that keeps private keys device-bound is what removes the live harvest surface, not a better detection rule after the fact.

Why doesn’t MFA 2.0 undo internal access after the Reddit phishing campaign?

MFA 2.0 does not undo Reddit’s post-authentication internal access once a valid employee session already exists. According to Reddit, after the credentials were obtained the attacker reached limited Reddit code, limited contact information for a small number of company contacts and employees, and limited advertiser information, while production systems including Reddit Ads were not impacted. No login control rewinds documents already opened under that session. Session kill, investigation, and least privilege are the containment work. Reddit said the employee self-reported and security removed the infiltrator’s access quickly. That is hygiene after the fact, not a claim that stronger MFA failed once the session already existed.

What should CISOs change to prevent Reddit-style AiTM workforce phishing?

CISOs should retire phishable workforce factors at login and treat prevention as the primary control, not alert fatigue after a completed proxy sign-in. Require device-bound credentials so a coached fake page has no password, OTP, or push to harvest. Keep enrollment and recovery free of SMS, email codes, and helpdesk-read secrets that recreate the same transferable surface. Shortening session lifetime does not stop AiTM credential phishing; it only forces reuse or re-theft sooner if a session was already minted. Prefer prevention over detection on the login path, and keep revoke ready for the residual case where malware steals a cookie from a machine that already signed in legitimately.

Did Reddit’s disclosure prove MFA was bypassed?

No. Public reporting does not establish that Reddit’s official findings post named MFA, 2FA, or second-factor token capture, and “bypass” is the wrong word for a post-auth session that already existed. The confirmed facts are sophisticated phishing, one employee’s credentials, and limited internal access afterward. Contemporaneous secondary reporting supplied the AiTM-class second-factor framing. The honest prevention claim is narrow and strong: remove transferable login factors so that class of kit never completes workforce authentication in the first place.