Resilience of the FIDO2/WebAuthn Protocol and Hardware Security Keys (YubiKey) Against Adversary-in-the-Middle (AitM) Phishing Attacks Compared to RFC 6238 TOTP: An Empirical Study and Architectural Framework

Automated application-layer (L7) reverse proxies (Evilginx3, Modlishka, Muraena) systematically defeat legacyMulti-Factor Authentication (MFA) relying on symmetric shared secrets (SMS OTP and RFC 6238 TOTP). By proxyingHTTP sessions in real time, adversaries extract authenticated session states (`Set-Cookie` headers and JWT Bearertokens) immediately upon issuance, rendering passwords and OTP harvesting incidental. This monograph presents anempirical study evaluating RFC 6238 versus asymmetric FIDO2/WebAuthn Level 3 implemented on hardware securitykeys: Yubico YubiKey 5 NFC (USB-A and USB-C, firmware 5.4.3, COSE ES256).Across 200 controlled laboratory trials evaluating 10 domain mutation typologies (D1–D10) and 4 protocol evasionstrategies (W1–W4), the password + TOTP scheme exhibited an Attack Success Rate of ASR = 100.0%,whereas hardware-bound FIDO2 demonstrated absolute resilience (ASR = 0.0%). Interception breaksdeterministically across three distinct trust boundaries: the browser rendering engine sandbox (W3C WebAuthn API),the physical token Secure Element (Common Criteria EAL6+ via CTAP2.1), and the server-side Relying Partycryptographic verifier. The evaluation adopts a Worst-Case Adversarial Model, assuming 100% human compliance tosocial engineering in order to rigorously stress-test the machine-deterministic verification state automaton.A microbenchmark ($N = 1000$ iterations on an AMD EPYC 9654 processor) reveals a mean server-side ECDSAP-256 verification latency of 0.1193 ms per CPU core (versus 0.0154 ms for HMAC-SHA1). Single-corethroughput exceeds 8,300 verifications per second, rendering cryptographic cost negligible compared to network andTLS round-trip times. Finally, the monograph defines enterprise Zero Trust deployment frameworks, key lifecyclemanagement (Primary USB-A and Backup USB-C), resilient account recovery mechanisms, and compliance mappingsto NIST SP 800-63B (AAL3), White House OMB M-22-09, EU NIS2, and PSD2/PSD3 SCA mandates.Keywords: FIDO2, WebAuthn Level 3, Passkeys, YubiKey 5 NFC, Adversary-in-the-Middle, AitM, Evilginx3, RFC 6238TOTP, Origin Binding, CTAP2.1, Secure Element, Defense-in-Depth, Zero Trust Architecture.