Phishing attacks exploit user trust to steal sensitive information, often bypassing security mechanisms like multi-factor authentication (MFA). While MFA enhances protection, advanced threats such as Adversary-in-the-Middle (AiTM) attacks can bypass it by capturing session tokens using tools like Evilginx. This study examines Evilginx’s functionality, confirming its ability to bypass MFA with minimal proxy-induced delays that are difficult to detect. We also assessed 48 websites in Japan and 54 global websites, revealing that 80% of major web services are vulnerable to Evilginx attacks, particularly those using traditional MFA methods. Only a minority adopt phishing-resistant technologies like FIDO2/WebAuthn. The originality of this work lies in its wide-scale evaluation of MFA adoption and vulnerabilities, with future efforts aimed at developing detection methods for proxy-based attacks and promoting secure MFA solutions. To analyze the effectiveness and detectability of AiTM attacks using Evilginx, we conducted two sets of experiments (1) Measuring Proxy-Induced Delay: We set up a test environment with Evilginx acting as a reverse proxy between users and a legitimate web service. We measured the elapsed time for login attempts with and without Evilginx to determine whether the additional proxy layer introduced a detectable delay in TLS handshake and authentication. (2) Assessing MFA Deployment and Vulnerability: We surveyed 48 websites in Japan and 54 global websites across various industries, including IT, ISPs, e-commerce, and finance. Each website was tested for MFA availability and categorized based on the types of authentication mechanisms implemented We then evaluated which authentication methods were vulnerable to Evilginx attacks by determining if session tokens could be captured and replayed.