Security Advisory
Preventing SMS Phishing & OTP Theft
How attackers steal one-time passcodes via reverse proxies (Evilginx) and social engineering, and how developers can harden login flows.
Modern OTP Interception & Reverse-Proxy Phishing
SMS OTPs are vulnerable to adversary-in-the-middle (AiTM) reverse proxy tools like Evilginx that intercept passcodes and session cookies in real time.
Key Interception Mechanisms:
- Adversary-in-the-Middle (AiTM): Attackers proxy real login pages to harvest OTP codes and session tokens.
- Social Engineering Vishing: Automated voice bots trick users into reading aloud SMS passcodes.
- SIM Porting Fraud: Unauthorized cellular carrier porting routes passcodes directly to attackers.
- Malicious Handset Apps: Sideloaded Android apps with SMS permissions read incoming codes silently.
To defend authentication systems, developers should implement domain-bound WebAuthn/Passkeys, rate-limit OTP verification attempts, and mandate push-notification approvals.
Recommended Enterprise Practice: Test your application's anti-brute-force rate limiting and anomaly detection using SMSRiver's synthetic failure simulation API.