Top 2026 2FA & AiTM Detection: Phishing Kit Hosted on Tunneling Infrastructure (

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•1

Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying requests to common tunneling services (e.g., ngrok, Cloudflare Tunnel) that include suspicious authentication or login-related URI paths, correlated with referrers from well-known email providers.