Phishing for Credentials

An adversary-in-the-middle phishing technique in which a proxy relays a user's sign-in to a legitimate web service. The proxy can capture credentials and the service-issued authenticated session cookie after the user completes the sign-in flow. Reuse of a captured session can give the attacker access without a new authentication prompt; this is session theft, not a vulnerability in MFA. This record focuses on the session-cookie theft outcome (ATT&CK T1539); phishing-link delivery is supporting behavior (T1566.002).