LIGHTNING TALK - Tunnel Vision

LIGHTNING TALK - Tunnel Vision: How White Lynx Uses WebSockets and Free Tunnels to Blind MFA

Sara McBroom, Palo Alto Networks Unit 42

To bypass modern authentication defenses, Belarusian threat actor White Lynx has abandoned traditional credential harvesting in favor of live, operator-driven WebSocket relays. This session unpacks the group's custom adversary-in-the-middle (AiTM) phishing kit and the highly disposable, tunnel-based infrastructure used to conceal it. We will share the behavioral anchors and registration fingerprints necessary to track this agile threat and defend targeted organizations in Eastern Europe.