The $0 MFA Bypass: How Open Source Tools Break Your Security

MFA is no longer a "silver bullet." Miguel Martinez and Ali Alwan demonstrate how free, open-source tools bypass modern authentication.

The Demo: A live Adversary-in-the-Middle (AiTM) and Browser-in-the-Middle (BitM) attack. They’ll showcase tools like Evilginx to proxy traffic and EvilnoVNC to launch a remote browser session. This allows them to intercept session tokens and clone active logins, rendering passwords and MFA codes useless.

The Problem: Attackers now use free GitHub "phishlets" to automate breaches against Microsoft 365 and Okta, exploiting vulnerabilities in SMS, TOTP, and Push notifications.

The Shield: Move beyond basic MFA. Protect your organization using FIDO2/WebAuthn hardware keys, device trust policies, and session anomaly detection.

Know what’s Happening Next — before everyone else does.

Get App

Host or Publisher Upstate ISSA Chapter