Traditional phishing steals a password. Adversary-in-the-middle phishing can go further by placing attacker-controlled infrastructure between the victim and the legitimate sign-in service.

The victim may see a convincing Microsoft sign-in page, enter credentials and complete MFA. The attacker relays that authentication to the real service and attempts to capture the authenticated session token or cookie.

MFA is not useless.It remains an important security layer. The lesson is that some MFA methods can still be phished, while passkeys and FIDO2-style methods are designed to resist this attack class.

Authentication has levels of strength

Authentication strength ladder from password to phishing-resistant passkey

Organizations should avoid interpreting every MFA method as equivalent. SMS and one-time codes are better than a password alone, but high-value and privileged accounts benefit from phishing-resistant methods.

What CyberEase recommends

Keep MFA enabled. Do not weaken authentication because a sophisticated technique can bypass some forms of it.

Move toward phishing-resistant methods. Prioritize administrators and users with access to sensitive data or financial workflows.

Investigate suspicious sessions. A successful MFA event is not automatically proof that the user intended the session.

Train for fake sign-in pages. Unexpected authentication links and unusual prompts deserve verification.

The right conclusion is not “MFA failed.” It is “use stronger MFA where the risk justifies it.”

Identity security is becoming less about adding another prompt and more about ensuring the authentication method itself is difficult for an attacker to relay or steal.

Sources: Current security research on Microsoft 365 adversary-in-the-middle phishing and Microsoft guidance on phishing-resistant authentication.

Simple IT. Strong Security. — CyberEase