Breaking

AI Is Lowering the Barrier to Phishing While Session Theft Raises the Stakes

October 27, 2026 at 09:33 EDT

Security
AI Agents

AI tools can make it easier to produce convincing, tailored phishing pages, but the threat can continue after a victim enters a password. In adversary-in-the-middle attacks, a criminal proxy can relay a login and capture the session cookie that keeps an authenticated account open.

AI AND PHISHING

A fake login can become a stolen session

AI can lower the effort to create convincing pages. AiTM phishing can relay sign-in traffic and capture the session cookie that keeps an account authenticated.

A phishing page generated in 30 seconds

Okta researchers demonstrated a fake Okta sign-in page built with Vercel v0.

30 secpage demo

Creation speed illustrates how natural-language tools can lower the effort to produce a lure. It does not show that the page stole credentials.

How the session is stolen

User enters credentials and completes sign-in → proxy relays the exchange → attacker captures the session cookie.

Why MFA may not stop it

A stolen cookie can represent an already authenticated session. Microsoft says this does not mean MFA itself is broken.

The campaign’s reported scale and speed

Microsoft observed a campaign targeting more than 10,000 organizations; follow-on payment fraud began as soon as five minutes after theft in observed cases.

10,000+organizations targeted

5 minto observed fraud

The columns show separate measures, not a shared scale.

Defensive focus

Pair MFA with conditional access signals and investigate unusual sessions and activity after sign-in.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.