Black Hat

Black Hat Europe 2025 | Insights From Phishing-Resistant Authentication

At Black Hat Europe 2025, Okta researcher Faelan presented a novel methodology that treats failed phishing‑resistant authentication attempts as a high‑fidelity sensor for adversary‑in‑the‑middle (AiTM) phishing. By mining FastPass logs that record cryptographic domain‑mismatch rejections, the team quantified a previously invisible threat vector across thousands of mature enterprises. The analysis covered 26 months of data—over 3 billion authentication events, 44,000 mismatched request origins, and 190 confirmed malicious domains. After rigorous expert, AI‑assisted, and customer validation, 170 “evil‑proxy” origins accounted for 310 user‑engagement incidents, translating to an average of 0.12% of organizations experiencing at least one AiTM event each month. Traditional MFA proved ineffective against these attacks, underscoring the unique value of phishing‑resistant mechanisms. Key findings highlighted that attackers rely on commercial cloud and VPS providers (e.g., Akamai, Digital Ocean) and rotate disposable domains to evade detection. Larger U.S. professional‑service firms were disproportionately targeted, and most compromised sessions originated from Microsoft Office 365 applications. The research also demonstrated that many organizations only discovered these events after Okta’s notification, revealing a critical gap in existing security monitoring. The implications are clear: enterprises must adopt phishing‑resistant authentication, continuously monitor failed FastPass signals, and integrate them into incident‑response workflows for IP blocking and SIEM enrichment. The conservative lower‑bound estimate likely understates the true prevalence, making this a compelling call to close a blind spot that could otherwise lead to costly account takeovers.