AiTM and session theft: what the app token protects and what it does not

Summary: credentials, codes and sessions are different

A password proves knowledge of a secret; a one-time code, or OTP, adds a check. A session cookie maintains continuity after authentication. Treating them as interchangeable can turn an authentication-relay or session-abuse problem into the vague diagnosis of a “failed token.”

For banks and fintechs, the useful question is not merely whether a second factor exists. It is what property the method provides and what happens after sign-in. This article synthesises third-party investigations; it is neither original intrusion telemetry nor an exhaustive list of affected banks.

What real-time intermediation changes

In the reverse-proxy pattern described by Sekoia, a fraudulent page relays authentication to the legitimate service and collects credentials and cookies. Its 1,200-plus domains are a historical provider count since August 2023, not LATAM banking domains or necessarily simultaneously active hosts.

The attack does not simply avoid stealing passwords: it may capture credentials as well as sessions. Equally, interactive phishing is not always proof of a reverse proxy. A live panel asking for a second code describes a capability whose implementation still requires investigation.

Classification should consider T1557, Adversary-in-the-Middle and T1539, Steal Web Session Cookie where supported. An ATT&CK identifier cannot replace an account of observed behaviour or establish how a particular incident worked.

A documented timeline, not a live market estimate

The Microsoft announcement of March 4, 2026 describes seizure of 330 active domains supporting Tycoon 2FA’s core infrastructure. It is an operation-specific result, not a census of all phishing infrastructure.

The Abnormal AI report dated May 6, 2026 describes a later rebuild: a campaign identified twenty days after the disruption and confirmed active on April 2. That supports the reported reappearance, not a claim that the operation had no effect or a new global market-share estimate.

In Sekoia’s Sneaky 2FA research, circulation since October 2024, discovery in December and publication in January 2025 are separate dates. The reported monthly price of $200 belongs to that investigation, not a current price check. The source does not establish that the Tycoon disruption caused increased Sneaky sales.

Three financial-sector cases—and their limits

Phoenix System. Group-IB describes live intervention in a panel found during global smishing research covering LATAM. Regional coverage is not equivalent to naming a compromised Latin American bank in the reviewed text.

ZeroTokens. Abnormal AI reports configurations for 53 financial brands across 14 locales and a concentration of organisations associated with .au domains. A template, brand or recipient is not automatically a compromised account. That distribution cannot be extrapolated to LATAM.

UNC6671. GTIG/Mandiant documents vishing and AiTM against employees and enterprise cloud environments, including financial services. That is not the same setting as a customer accessing personal online banking.

The conclusion is restricted to these references: this article does not establish a sufficiently identified Latin American banking incident from their text. It does not claim that incidents or regional research outside this set do not exist. See the dataset’s citability and scope criteria.

Separate authentication, sessions and payment authorisation

NIST SP 800-63B-4 does not treat manually entered OTPs as phishing-resistant. It describes cryptographic verifier binding and gives WebAuthn/FIDO2 as an example. A push notification showing payment details does not, by itself, establish the same property.

For a defensive review, ask three distinct questions: can an impostor relay authentication, can the resulting session be reused elsewhere, and what operation does the payment confirmation authorise? Displaying amount and recipient may support an authorisation design; it is not automatically equivalent to a phishing-resistant protocol.

Protecting the credential also does not justify declaring the entire account invulnerable. Recovery, enrolment, device changes, session management and sensitive operations remain part of the review. These are proposed assessment areas, not findings from a test of a specific bank application.

Regulatory scope and limits of the evidence

Statements about biometrics, SMS and financial regulation in Mexico and Brazil that were not verified against a current primary source are not used here to infer compliance, non-compliance or region-wide requirements.

A technical comparison of authentication mechanisms is not a legal conclusion. A publishable regulatory overview still requires a primary provision, date and applicable institutions or channels for each assertion.

Three decisions for a defensive review

Separate the mechanisms. Record credentials, OTPs, cookies and payment authorisations distinctly. Stolen codes alone do not prove use of a reverse proxy.

Test the complete flow. Evaluate phishing-resistant authentication alongside account recovery and session controls without promising that one measure eliminates every attack.

Require a verifiable scope. A claim about regional victims needs a source, country, period and evidence type. Brand templates, broad regional references and confirmed incidents need different labels. This synthesis adds no IOCs and attributes no common operator to the cases.