How to steal credentials and bypass MFA (for educational purposes, of course)

Think MFA is your get-out-of-breach-free card? Think again.

In this demo-packed session, I will showcase how attackers are using tools like Evilginx to steal credentials and bypass MFA like it's 1999 and no one's watching. From phishing pages that mirror the real thing to session hijacking so seamless you'd swear it was magic - this is the side of adversary tradecraft that defenders need to see to believe.

But it’s not just a “look what the bad guys can do” show. I will connect the dots between these tactics and what we see happening next every single day.

Spoiler alert: credentials are still the golden goose, and Evilginx makes cooking the eggs easier than ever.

You’ll walk away with a better understanding of the tools, the techniques, and more importantly, how to spot and stop them before your users become someone else’s remote desktop shortcut.

(Warning: Side effects may include existential dread and sudden urges to disable legacy authentication.)