Bluekit PhaaS OTP/TOTP Relay: MFA Bypass via Proxy IP Mismatch

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects MFA authentication success from one IP address followed immediately by a session access attempt from a different IP address. This pattern is characteristic of Adversary-in-the-Middle (AiTM) phishing attacks, such as those using EvilProxy, Evilginx2, or similar phishing-as-a-service (PhaaS) platforms, where an adversary proxies the authentication flow to capture session tokens.