UNC6671 AiTM Reverse-Proxy MFA/OTP Interception Path Hit on Known Phishing Infrastructure

Duo Tech@duotech

•updated Aug 9, 2026•0•0•7

Detects HTTP requests to known UNC6671 AiTM reverse-proxy phishing kit IPs on MFA/OTP interception URI paths (push-tap, duo-push, oauth2 2fa, community verify), indicating live MFA bypass.