Two-Factor Authentication Is No Longer As Safe Thanks To This Cybersecurity Trick For a while, it seemed like two-factor authentication was going to stump hackers for years to come. Its strength lies in giving you two distinct factors of authentication, mainly what you know and what you own. That is why when you enter a password (something you know) on a certain website, you're also asked to enter a code sent to your phone, tablet, or computer (something you own) in the form of a text message or push notification. It can also be something you are, like a fingerprint or facial scan. It is the second factor that presents a challenge for cybercriminals trying to hack you thousands of miles away, but now it seems they have found a way around it using a tool called Evilginx. Once you log into a website using 2FA, you begin what's known as an authenticated session. Using Evilginx, they're hijacking the session cookies, which are temporary data files in your web browser that contain various information about the session, including the session ID of the successful login, to fool the website into thinking you're the one who has logged in. So all they have to do to bypass 2FA is wait for you to complete the login process, allowing them to steal your password and gain access to all your personal information stored on your site. How hackers use Evilginx to bypass 2FA With normal phishing, the hacker creates a fake website that looks like a legit login portal for something you use. It can be the login page for a bank, cloud service, social media profile, or eCommerce site. The problem is that the 2FA code goes to your phone and requires extra steps to trick it out of you. So