how it happened
- whoattackercloned intranet page
- the targetpassword and 2FA coderelayed in real time
- theninternal systemsdocs, code, dashboards
- how it stoppedemployee reported itdamage limited
what everyone assumed
Two-factor authentication is sold as the answer to phishing: even if the password is stolen, the second factor stops the attacker. The assumption is that 2FA makes a phished password useless.
what happened
The cloned page captured the password and the live second-factor code together and relayed them immediately to the real site, completing a genuine login. The 2FA worked exactly as designed; it just authenticated the attacker, who had both halves in real time.
step by step
- an employee lands on a cloned intranet pageIt asks for password and 2FA code.
- both are relayed to the real site in real time2FA works and authenticates the attacker.the assumption breaks here
- internal docs, code and dashboards reached
- February 2023the employee self-reportsWhich limits the damage.
how it surfaced
In February 2023 Reddit disclosed that one employee’s credentials and 2FA token, phished through a cloned intranet page, gave an attacker access to internal documents, source code, and dashboards. The employee self-reported, which limited the damage.
Code-based and prompt-based 2FA stops a reused password, not a real-time relay.
A phishing page that captures the second factor as the user enters it defeats the second factor, because the user hands over both.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe employee logs in, and so does the attacker.what it costs youInternal documents and code are copied. Two-step login worked, for the wrong person.
- or it goes like thisit happenedUber, 2022howLogin prompts keep coming until a tired employee taps approve.what leavesadmin tools and company chatwho ends up with itan attacker who bought a contractor's password
- or it goes like thisit happenedRetool, 2023howA caller posing as IT gets one code, and synced codes unlock the rest.what leavescustomer accounts and fundswho ends up with itthieves
sources
your turn
what you can do about it
this week
Check which second factor guards your most sensitive logins.
Your 2FA, if it is an app code or a push, can be relayed through a convincing fake login in real time, exactly as Reddit's was. Only factors bound to the genuine domain resist that. Which kind protects your most sensitive logins is the difference between Reddit's near-miss and a worse story.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →