MFA phishing is no longer a niche technique. In October 2025 alone, Microsoft blocked more than 13 million phishing emails tied to a single kit called Tycoon 2FA. That’s one phishing-as-a-service platform, in one month. Two-factor authentication was supposed to stop this kind of attack cold. Instead, attackers found a way to weaponise the trust users place in that second step.

Rather than stealing a password and hoping it still works, it takes a more direct route. It intercepts or tricks users into handing over the one-time code or approval that grants full access. In short, what was once a reliable defence has become a new attack surface. Three major breaches show exactly how it happens.

How MFA Phishing Actually Works

MFA phishing falls under real-time phishing and adversary-in-the-middle, or AiTM, techniques. Instead of stealing stored credentials, attackers aim to intercept the codes or approvals a user provides in the moment. It usually plays out in four steps.

1. Initial phishing or redirection. The victim gets a phishing email or lands on a spoofed login page. Often, it’s a near-perfect copy of a Microsoft 365, Okta, or Google Workspace login screen.

2. Simultaneous proxying. Behind the scenes, the fake page connects to a real-time relay tool, like EvilProxy or Modlishka. The attacker forwards the victim’s credentials to the real service, and the MFA challenge comes back through the same channel.

3. Real-time prompt theft. The victim enters their code or approves a push notification, believing they’re logging in securely. Meanwhile, the attacker completes the same login in parallel and gains full access.

4. Session token harvesting. In more advanced versions, attackers extract and reuse session tokens or cookies. This lets them skip further MFA challenges entirely, until the token expires.

3 Famous Breaches That Started With MFA Phishing

These aren’t hypothetical scenarios. Each of the following breaches was confirmed publicly and documented by security researchers.

Uber, 2022. An attacker linked to the Lapsus$ group bought a contractor’s stolen password on the dark web. From there, they triggered dozens of MFA push notifications, sending around 40 in just 30 minutes. Posing as Uber IT support, the attacker messaged the contractor and said approving one would make the notifications stop. Exhausted, the contractor tapped approve. Within minutes, the attacker had access to Uber’s internal Slack, VPN, and source code repositories.

Cisco, 2022. This attack combined MFA push bombing with old-fashioned vishing. First, the attacker compromised an employee’s personal Google account, where Cisco credentials had synced via a browser. From there, they pushed repeated MFA prompts to the employee’s phone. That didn’t work right away, so they followed up with phone calls, posing as trusted support staff in different accents. Eventually, the employee accepted a push. The attacker, linked to Yanluowang ransomware operators, gained VPN access and exfiltrated internal files.

Reddit, 2023. A phishing site cloned Reddit’s internal intranet login. Unlike simple credential phishing, this page was built to capture both the employee’s password and their MFA token at once. It relayed both to Reddit’s real login system before the token expired. That’s textbook AiTM. As a result, the attacker accessed internal documents and source code, though Reddit confirmed user passwords weren’t exposed.

Why MFA Phishing Works So Well

Several factors make this technique so effective:

• Interface familiarity. Victims see what they expect to see. Attackers invest in pixel-perfect replicas of real login and MFA screens.
• Relay tools are cheap and widespread. Toolkits like EvilProxy have been sold as phishing-as-a-service for as little as $150 for ten days. That puts AiTM within reach of low-skill attackers, not just nation-states.
• MFA fatigue is real. Frequent prompts desensitize people. After the fifth push notification in ten minutes, most people just want it to stop.
• Cloud-first environments lack a perimeter. Identity is the new perimeter, and a stolen session token grants access without tripping traditional alarms.

How to Stop MFA Phishing

Move to phishing-resistant MFA. TOTP codes and push notifications can both be relayed. FIDO2 and WebAuthn credentials, by contrast, are cryptographically bound to the device and the site origin. Because of this, a cloned login page simply can’t use them. CISA and NIST classify FIDO2 security keys and platform authenticators as the only genuinely phishing-resistant options available today.

Add contextual authentication. Risk-based policies help catch what a stolen token alone won’t. For example, if a login comes from an unusual location or an unrecognized device, the system should force step-up verification, or block it outright.

Shorten token lifespans. Limiting how long a session token stays valid narrows the attacker’s window. Re-authentication policies and token binding also help prevent reuse altogether.

Deploy inline threat detection. Services that detect known phishing kits and AiTM proxies can catch an attack before a user ever reaches the fake page. In addition, DNS filtering and browser isolation add further layers.

Train users to notice red flags. Being asked to enter a code twice is one warning sign. So is an MFA prompt that arrives out of context, or a slightly altered domain, like “micr0soft-login.com.” Security awareness training still matters, even with stronger technical controls in place.

Audit logs and revoke tokens fast. Watch authentication logs for logins from multiple regions or IPs in a short window. Once something looks wrong, revoke the session immediately rather than waiting to investigate first.

Why Phishing-Resistant MFA Is the Real Fix

The industry is already moving this direction. According to the FIDO Alliance’s State of Passkeys 2026 report, 68% of organizations have deployed or are actively deploying passkeys for workforce sign-in. Globally, roughly 5 billion passkeys are now in active use. On the consumer side, 48% of the top 100 websites now offer passkeys, more than double the 2022 figure.

The payoff is significant. Microsoft’s Digital Defence Report 2025 found that phishing-resistant MFA blocks more than 99% of identity-based attacks. Notably, that holds true even when an attacker already has a valid username and password. In other words, that’s the gap between MFA that merely exists and MFA that actually holds up against AiTM.

MFA Phishing Means MFA Alone Isn’t Enough

Fake MFA prompts are a wake-up call. Trust has to be verified continuously, not just at the moment of login, but across the entire session lifecycle. As attackers refine AiTM and token-theft techniques, relying on legacy TOTP and SMS-based MFA becomes riskier every year.

The convenience of push-based MFA should never outweigh its risks when it’s deployed without hardening. At this point, trusting an MFA prompt blindly is nearly as risky as trusting a password alone. So organizations need both pieces: phishing-resistant authentication, and users trained to spot deception. Only then can they reclaim real confidence in the second step of login.

Frequently Asked Questions

What is MFA phishing? MFA phishing, also called adversary-in-the-middle or AiTM phishing, is an attack where a fake login page relays a victim’s credentials and one-time code to the real service in real time. That’s how the attacker completes the login themselves.

Can MFA phishing bypass push notifications and authenticator apps? Yes. Both TOTP codes and push-based approvals can be relayed, or triggered repeatedly until a user approves one by mistake. That’s exactly what happened in the Uber and Cisco breaches.

What is phishing-resistant MFA? It’s authentication that can’t be relayed through a fake page, because the credential is cryptographically bound to the real device and site. Specifically, CISA and NIST recognize FIDO2 security keys and platform authenticators, like passkeys, as the only methods that qualify.

How common are MFA phishing attacks in 2026? Very common. Microsoft blocked over 13 million phishing emails linked to the Tycoon 2FA kit alone in October 2025. Meanwhile, phishing-as-a-service platforms have made AiTM accessible to low-skill attackers.

Is switching to passkeys difficult for a large organisation? It’s a real project, but adoption is accelerating. Per the FIDO Alliance, 68% of organisations were deploying passkeys for workforce sign-in as of the 2026 report. Already, platform-native systems like Windows Hello, Apple Touch ID, and Google Password Manager cover most workforce devices.

Further Reading

• CISA – Implementing Phishing-Resistant MFA (fact sheet)
• Resecurity – EvilProxy Phishing-as-a-Service with MFA Bypass
• Okta – Phishing-Resistant Authentication
• Microsoft Security Blog – Detecting and Mitigating a Multi-Stage AiTM Phishing and BEC Campaign
• Yubico – Passkeys and the Future of Modern Authentication
• TechCrunch – Reddit says hackers accessed employee data following phishing attack
• Dark Reading – Uber Breach: External Contractor MFA Bombing Attack

Talk to our team about hardening your identity and MFA infrastructure → info@technohub.cloud

Read More Here