The Saturday Afternoon Heist: How a Curious Click Almost Cost Everything

I. The Bait

It was a Saturday afternoon—the kind of weekend lull that attackers love. Most users are offline, distracted, or simply not paying attention to their inboxes. The attacker’s assumption is simple: “No one is watching on a Saturday.”

And then the user sees it.

An Instagram profile—a model, Brazilian, with a handful of photos. Not obviously fake, but something feels off. The algorithm has been pushing both legitimate World Cup fan profiles and AI-generated ones lately. This one lands in the feed, and they pause.

Curiosity is a hell of a thing.

The user clicks the link in the bio. It’s supposed to lead to a chat group—something to verify whether it’s a legitimate social space or just another paid content trap. The link doesn’t open properly. It hangs, loading endlessly, before the user gives up and moves on.

What the user doesn’t know is that in those few seconds, their session has already been stolen.

II. The AI-Generated Fan Phenomenon

This is not a hypothetical scenario. In June 2026, as the FIFA World Cup captivated global audiences, a parallel phenomenon was unfolding across social media: the viral spread of AI-generated “fan” images.

Finnish public broadcaster Yle reported that AI-generated images of attractive female football fans were spreading explosively across platforms including Instagram, X (formerly Twitter), Facebook, TikTok, and Reddit. One image of a supposed Norwegian fan alone accumulated over 1.5 million views and tens of thousands of likes on X.

But the image wasn’t real.

Yle’s investigation revealed several telltale signs: the match clock in the image didn’t match the international broadcast feed, background figures appeared to merge into each other at the shoulders, and one man’s shirt featured a sloppy Nike-like logo.

Even more striking was the case of a Brazilian fan video that went viral—amassing hundreds of millions of views. The video showed a woman watching a match intently while the man beside her stared at her chest. The European Broadcasting Union’s Spotlight fact-checking network traced the video to an account belonging to an “AI influencer” named Chiara Cleo—a character who does not exist in the real world.

These images are being shared across hundreds of social media accounts. Many are posted without any disclosure that they are AI-generated. And when Yle asked X’s AI tool Grok about one such image, it responded that “such authentic, joyful fan images spread easily on social media”—demonstrating that even AI detection tools can be fooled.

The takeaway is clear: AI-generated profiles are no longer a hypothetical threat. They are here, they are proliferating, and they are being weaponized.

III. The Mechanism: How a Click Becomes a Breach

This is not a password breach. The user never enters their credentials. They have 2FA enabled—push notifications on their mobile devices. By every conventional measure, their account should be secure.

And yet, when they later check their Google Account’s active sessions panel, they see something that doesn’t belong: a Linux session logged in from an unfamiliar location.

Here’s how that happens.

The Adversary-in-the-Middle (AitM) Proxy

The link is a reverse-proxy phishing trap—leveraging a framework like Evilginx2, a widely available open-source tool designed specifically for this purpose. These frameworks operate on what security researchers call an adversary-in-the-middle (AitM) architecture.

Here’s the technical breakdown:

The attacker sets up a proxy server that sits between the victim and the legitimate service (in this case, Google).
When the victim clicks the link, their traffic is routed through this proxy.
The proxy relays the authentication request to the real Google servers.
Because the victim is already logged in, Google returns a session cookie—the digital “pass” that proves authentication.
The proxy captures this cookie in real-time and saves a copy.
The attacker imports the cookie into their own browser, effectively becoming the victim without ever knowing their password.

This is what’s known as session hijacking—and it completely bypasses both passwords and 2FA.

As Okta’s threat intelligence team documented in their analysis of the EvilProxy campaign, these attacks use “a reverse-proxy/adversary-in-the-middle (AitM) architecture to intercept victims’ logins and session cookies in real time, allowing attackers to bypass multi-factor authentication (MFA) and hijack accounts.”

The frameworks are mature and widely available. Evilginx itself is open-source, written in Go, and “implements its own HTTP and DNS server, making it extremely easy to set up and use”. Phishing-as-a-Service (PhaaS) platforms like VoidProxy have productized these capabilities, lowering the technical barrier for attackers even further.

The attack is almost invisible to the victim. The proxy “acts as a hidden intermediary, relaying information back and forth while secretly copying everything that passes through”. Users see real MFA prompts from the legitimate service—because they are real—and the attacker captures the tokens and cookies for later replay.

Why “The Link Didn’t Open Properly”

That broken loading screen? That is the proxy failing. Either the attacker’s infrastructure is misconfigured, the session is interrupted, or the proxy crashes mid-attack. But by the time the user sees that blank page, the damage is already done—the session cookie has already been exchanged and captured.

The user is left with a broken link and no idea that their session token is now in the hands of an attacker halfway across the world.

IV. The Attacker’s Playbook: What They Do Once They’re In

Session hijacking is just the entry point. Once an attacker has a live session, they follow a predictable checklist.

Step 1: Search for Crypto

Crypto is the primary target because transactions are irreversible and pseudonymous. Attackers search Gmail for keywords like “Coinbase,” “Binance,” “Kraken,” “wallet,” “seed phrase,” “withdrawal,” and “transaction.” With access to an inbox, they can perform business email compromise, reset passwords, and escalate to privileged systems.

Step 2: Check OAuth Connections

OAuth connections are a goldmine because they are often forgotten by users and can bypass passwords and 2FA entirely. If an attacker finds an exchange connected via “Sign in with Google,” they can access it without ever needing the exchange password.

Worse, researchers have identified malware families abusing an undocumented Google OAuth endpoint called “MultiLogin” to restore expired authentication cookies and maintain access even after a password reset. As one security report noted, “information stealing malware are actively taking advantage of an undocumented Google OAuth endpoint named MultiLogin to hijack user sessions and allow continuous access to Google services even after a password reset”.

Step 3: Register a Passkey

Passkeys are designed to be more secure than passwords—they’re resistant to phishing because they’re device-bound cryptographic keys. But when an attacker already has a live session, they can register their own device as a trusted passkey. This creates a backdoor that persists even after the victim changes their password.

As one researcher noted, “if your device is infected, they can hijack your authenticated session and access systems without ever touching a login page”. And “as more organizations adopt passkeys, device compromise and session hijacking will become the primary identity threats”.

Step 4: Set Up Persistence

Attackers also check Gmail filters and forwarding rules to hide their tracks, add delegates for ongoing access, and exfiltrate saved passwords from Google Password Manager.

The Priority List

The attacker’s checklist is ruthlessly efficient:

Search for crypto (quick cash)
Check OAuth connections (persistent access)
Register a passkey (backdoor after password reset)
Set up filters/forwarding (hide tracks)
Add a delegate (ongoing access)
Exfiltrate saved passwords (expand the breach)

V. The Interception: How the Attacker Is Caught

In the observed incident, the user happened to be working remotely with their inbox open. They glanced at their Google Account’s active sessions panel and saw something that didn’t belong: a Linux session logged in from an unfamiliar location.

The user didn’t hesitate. They clicked “Sign out” and terminated the session immediately. The attacker was mid-browse—actively scrolling through emails, searching for crypto, probably in the middle of their checklist. And the user pulled the plug.

The attacker had been inside for perhaps fifteen minutes.

The Aftermath: Sweeping for Backdoors

Terminating the session wasn’t enough. The user assumed the attacker had left something behind and conducted a full sweep:

Passkeys: Found and deleted the passkey the attacker had registered.
App Passwords: Checked and found none generated.
OAuth Apps: Reviewed all connected apps—all legitimate.
Delegated Access: None added.
Gmail Filters: None created.
Forwarding: None enabled.

Total damage: 15 minutes of the user’s time.

No crypto stolen. No data exfiltrated. No impersonation emails sent. No reputation damaged.

VI. The Bigger Picture: Mass Exploitation at Scale

This wasn’t a targeted attack. The user wasn’t specifically chosen. The attacker was running a numbers game.

The Instagram Honeypot

The Brazilian model profile was almost certainly part of a mass-exploitation operation. With generative AI, scammers can now “fabricate fake profiles, misleading ads, and entire brand replicas in seconds”. Perpetrators use deepfake images for profile photos—people who don’t even exist.

The profile had:

2 to 15 photos of the same woman
No background story
No plausible real identity
A link in the bio that led to a phishing proxy

It was either AI-generated or a burner account. Either way, it was bait.

The algorithm was complicit. Instagram’s recommendation system doesn’t know the difference between a real fan and a honeypot. Once these profiles get enough engagement, the algorithm pushes them into more feeds. The attacker seeds hundreds of profiles, waits for the algorithm to do its work, and harvests session tokens from the tiny percentage who click.

The Numbers Game

The attacker’s calculus is simple:

Create 1,000+ AI/burner profiles
Seed them across Instagram
Let the algorithm amplify them
Wait for clicks
Harvest session tokens from the 0.1% who bite
Rinse and repeat

For every 10,000 users who scroll past, one will stop. For every 100 who stop, one will click. For every 10 who click, one will have an active Google session. That’s all they need.

They don’t need you to be stupid. They just need you to be human.

VII. The Invisible Vulnerabilities

What makes this attack so insidious is that it exploits gaps in how most users understand security.

The 2FA Illusion

Two-factor authentication is not a silver bullet. As security researchers have documented, “phishing attacks that harvest session tokens render multi-factor authentication (MFA) less effective because they enable hackers to impersonate users”. The AitM proxy captures the session cookie after MFA verification, making the 2FA completely irrelevant.

The Passkey Blind Spot

Passkeys are marketed as phishing-resistant, but they create a new vulnerability: users don’t know they exist, don’t know how to check them, and don’t know they can be registered by an attacker who already has a live session. “Malicious or compromised browser extensions can hijack WebAuthn requests, manipulate passkey registration or sign-in, and drive autofill to leak credentials and one-time codes”.

The Session Token Blind Spot

Most users don’t know what a session token is. They don’t know that changing their password doesn’t automatically invalidate all existing sessions. They don’t know that a session token can be stolen without entering credentials. And they don’t know to check their active sessions panel—or what to look for when they do.

The Algorithmic Accomplice

The attacker doesn’t need to send phishing emails that get caught by spam filters. They can use social media platforms’ own recommendation algorithms to deliver their bait directly into users’ feeds. The algorithm becomes an unwitting accomplice.

VIII. The Defense: What You Can Do

For the Average User

Check your active sessions regularly. Go to myaccount.google.com/security and look at “Your devices.” If you see something you don’t recognize, sign it out immediately.
Check your passkeys. In the same security panel, look for “Passkeys” and delete any you don’t recognize.
Check your OAuth connections. Under “Third-party apps with account access,” review and remove anything suspicious.
Check your Gmail filters and forwarding. Attackers often set up rules to hide their tracks.
Don’t click links in Instagram bios. A legitimate group will have a searchable name. You don’t need to click to verify.
Enable phishing-resistant 2FA. As Okta’s researchers noted, “the best way to protect your users against threats like [AitM phishing] is to enroll [them] in phishing resistant authenticators”.

For the Security-Conscious

Regularly audit your account. Make it a habit—weekly or monthly—to review active sessions, passkeys, OAuth connections, and Gmail settings.
Use a password manager. But be careful with autofill—only use it on URLs you 100% recognize and trust.
Enable Enhanced Safe Browsing in Chrome. It helps protect against phishing sites.
Consider using physical security keys. They are resistant to AitM attacks because they validate the domain of the authentication request.
Be suspicious of “broken” links. If a link doesn’t load properly, it might be a phishing proxy that failed.

IX. The Post-Mortem

The attacker chose Saturday afternoon because they assumed no one would be watching. They assumed the user was offline, distracted, or simply not paying attention.

They were wrong.

The user was working. Inbox open. Active. And when they saw that Linux session in Helsinki, they didn’t freeze. They didn’t panic. They didn’t finish their work first. They terminated the session immediately.

The attacker had fifteen minutes inside the account. They registered a passkey. They started searching for crypto. And then they were gone.

Total loss for the attacker: 15 minutes of effort, zero reward.
Total win for the user: Full security, zero compromise, complete intelligence on their methods.

The attacker’s script wasn’t built for someone who checks their active sessions. It was built for the 99.9% of users who wouldn’t notice, wouldn’t care, and wouldn’t know what to do.

The user broke the script.

X. The Lesson

“If they were good, you wouldn’t have seen them. Since you saw them, they weren’t good.”

This wasn’t a sophisticated state-level operation. It was a low-tier, opportunistic, financially motivated attacker running a mass-exploitation campaign. They cast a wide net, someone swam into it, and then they cut the net open with a knife and swam out.

But the real lesson is this: most users wouldn’t have noticed.

They wouldn’t have checked their active sessions. They wouldn’t have known what a passkey was. They wouldn’t have known to check OAuth connections or Gmail filters. They would have changed their password, felt safe, and been re-compromised the next day.

The attacker counted on that ignorance. And for most victims, it works.

That is the real vulnerability. Not the technology. Not the 2FA. Not the passkeys. The gap between what users know and what attackers exploit.

Close that gap. Check your sessions. Audit your passkeys. Review your OAuth connections. Be suspicious of broken links. And for heaven’s sake, don’t click links in Instagram bios on a Saturday afternoon.

XI. The Trend

This is not an isolated incident. It is a growing trend that security researchers are actively tracking.

The Rise of PhaaS and AitM Toolkits

The commercialization of phishing infrastructure has lowered the barrier to entry dramatically. Platforms like VoidProxy and EvilProxy offer “phishing as a service” with “built-in protection mechanisms” that make it easy for even inexperienced attackers to launch sophisticated campaigns.

These services provide:

Ready-made reverse-proxy infrastructure
Automatic session cookie harvesting
Bypass mechanisms for MFA and 2FA
Templates for impersonating Google, Microsoft, and other major platforms

The AI-Generated Social Media Bait

Generative AI has made it trivial to create realistic fake profiles at scale. Attackers can now generate hundreds of “people” with convincing photos, bios, and engagement histories. These profiles are used as honeypots to lure users into clicking malicious links.

The Algorithmic Amplification

Social media algorithms are not designed to detect malicious profiles. They are designed to maximize engagement. A well-seeded fake profile that generates clicks will be promoted by the algorithm, accelerating the attack’s reach.

The Session Token Blind Spot

Session hijacking is not a new technique, but it has become more effective as organizations have adopted MFA. As one researcher noted, “users and security controls focus on passwords and MFA, but the session token—the literal key to the kingdom—is often left unprotected”.

Sources

Yle. “Näitkö kuvan kauniista naisesta MM-katsomossa? Hän saattoi olla tekoälyn luomus.” June 2026. https://yle.fi/a/74-20232988
Okta Threat Intelligence. “EvilProxy phishing campaign leverages convincing impersonations of enterprise applications.” September 2025.
Infoblox Threat Intel. “Infoblox Uncovers MFA-Bypassing ‘Evilginx’ Phishing Operation Targeting U.S. Universities.” December 2025.
JFrog. “Everything You Need to Know About Evil Proxy Attacks and MFA Bypass.” November 2024.
GitHub. “kgretzky/evilginx2: Standalone man-in-the-middle attack framework.”
ThaiCERT. “VoidProxy: New Phishing Service Bypasses MFA to Target Microsoft and Google Accounts.” September 2025.
Okta. “Security researchers uncover VoidProxy, an advanced MFA-bypassing phishing platform.” September 2025.
CloudSEK. “Compromising Google Accounts: Malwares Exploiting Undocumented OAuth2 Functionality for session hijacking.” August 2025.
The Hacker News. “Malware Using Google MultiLogin Exploit to Maintain Access Despite Password Reset.” January 2024.
Bleeping Computer. “Malware abuses Google OAuth endpoint to ‘revive’ cookies, hijack accounts.” December 2023.
BrandShield. “AI Scams & Fake Profiles: Protecting Your Brand on Social.” April 2025.
The Hacker News. “How Attackers Bypass Synced Passkeys.” October 2025.
Security Boulevard. “The Industry’s Passkey Pivot Ignores a Deeper Threat: Device-Level Infections.” September 2025.
Cybersecurity Insiders. “How Attackers Turn One Login Into Total Compromise.” June 2025.
European Broadcasting Union (EBU) Spotlight Fact-Checking Network. “World Cup 2026 Misinformation: AI Fakes.” June 2026. https://spotlight.ebu.ch/p/world-cup-2026-misinformation-ai-fakes
RTBF. “Coupe du monde : ces images de jeunes femmes dans les stades sont générées par IA.” June 2026. https://www.rtbf.be/article/coupe-du-monde-ces-images-de-jeunes-femmes-dans-les-stades-sont-generees-par-ia-11741694