Yaamini Barathi Mohan

Vice President

Women in Cybersecurity

Roadblock Title:

Bypassing the Stack: How AiTM and “Trusted” Infrastructure Are Defeating Your MFA

Time:

Tuesday - 1:00 PM (Tower B)

Abstract:

A new wave of account takeover (ATO) attacks is systematically bypassing multi-factor authentication (MFA) by exploiting trust boundaries and identity architecture—not application vulnerabilities. Threat actors are increasingly leveraging legitimate Microsoft and Azure-hosted infrastructure to deliver highly convincing phishing campaigns that evade traditional detection.

Most critically, adversaries are deploying Adversary-in-the-Middle (AiTM) proxy frameworks to intercept and replay authenticated sessions in real time—effectively neutralizing MFA and granting full account access. For fintech platforms, where session integrity underpins both security and regulatory compliance, this represents a fundamental shift in the threat landscape. This session provides a technical dissection of modern ATO techniques in a fintech context. We will:

Deconstruct an AiTM attack against a real-world fintech authentication flow
Analyze how “consent phishing” abuses OAuth grants to establish persistent access without credentials
Examine why conventional network and device signals (IP reputation, user agent, geolocation) are no longer reliable indicators of compromise

We will conclude with architectural strategies designed to eliminate token theft as an attack vector, including phishing-resistant authentication (FIDO2/passkeys), token binding concepts, and emerging browser-native security signals.

Attendees will leave with a clear understanding of how these attacks work—and what it takes to redesign identity defenses for high-risk financial environments.

Bio:

Yaamini Barathi Mohan is a cybersecurity professional, AI security advocate, and mentor with a passion for cloud security, vulnerability management, and AI-driven security solutions. As the Vice President of WiCyS Austin, she is dedicated to fostering innovation and supporting diversity in the industry. With experience in Vulnerability Management at Dell Technologies and Ethical Hacking at RSA Security, Yaamini has worked across penetration testing, threat intelligence, and security automation. Along the way, she has been honored with recognitions such as Cybersecurity Woman of the Year, the SANS Difference Maker Award 2024, the Cyberjutsu Rising Star Award, and inclusion in the Top 50 Mentors in the U.S. Beyond her technical work, Yaamini is committed to mentorship and community building, actively supporting women and underrepresented groups in cybersecurity through platforms like Ask Me and Topmate.io. She enjoys speaking at conferences, sharing insights on AI-powered security automation, ethical hacking, and cloud security challenges, and learning from the experiences of others in the field. She believes that continuous learning and collaboration are key to staying ahead in cybersecurity. By bridging the gap between AI and security, Yaamini hopes to contribute to a smarter and more resilient digital future.