Why MFA Alone Is No Longer Enough to Protect Your Business

Multi-factor authentication represents one of the most critical security controls available to organisations. Implementing MFA on Microsoft 365 accounts is non-negotiable and continues to block the majority of automated credential-stuffing attempts. However, organisations should not assume MFA provides complete protection, as attackers are actively exploiting its limitations.

Three Ways Attackers Are Beating Standard MFA

1. Adversary-in-the-Middle (AiTM) Attacks

Proxy tools like EvilProxy and Tycoon 2FA position themselves between users and legitimate login pages, capturing credentials and MFA codes simultaneously. Attackers primarily target the authenticated session cookie rather than the password or code itself, completely circumventing standard TOTP and push notification MFA methods.

2. MFA Fatigue (Push Bombing)

This social engineering technique exploits push notification-based MFA by bombarding users with repeated authentication requests, often at inconvenient times. The objective is to pressure users into approving requests simply to stop the notifications. Number Matching — a Microsoft Entra ID feature requiring users to enter a two-digit code shown in their authenticator application — substantially reduces this attack's effectiveness. Organisations still using simple approve/deny prompts should update their settings immediately.

3. SIM Swapping

SMS-based MFA represents the weakest authentication approach. Attackers convince mobile carriers to transfer target phone numbers to SIM cards under their control, gaining access to all SMS messages including MFA codes. Businesses relying on SMS should migrate to authenticator applications or FIDO2 standards.

What Phishing-Resistant MFA Actually Looks Like

Phishing-resistant authentication methods cannot be intercepted by proxy attacks because they employ cryptographic binding to specific domains.

FIDO2 / Passkeys

These security keys or built-in biometric authenticators use public-key cryptography and register with specific domains. The authenticator refuses to validate against any other domain, including identical-looking phishing sites. When browsers attempt authentication through proxy servers, FIDO2 authenticators reject the request due to domain mismatch.

Certificate-Based Authentication (CBA)

Digital certificates stored on devices authenticate users and are common in government and enterprise settings. This method is also phishing-resistant, though FIDO2 passkeys typically offer more practicality for small and medium-sized businesses.

Beyond MFA: The Layered Security Model

Phishing-resistant MFA alone provides incomplete protection. A compromised device with registered FIDO2 credentials still poses risks. Effective security requires multiple independent protective layers:

• Conditional Access policies restrict sign-ins by requiring compliant devices, enforcing location restrictions, and limiting after-hours access.
• Endpoint Detection and Response (EDR) identifies post-compromise activity even when credentials remain valid.
• Sign-in risk policies flag and block suspicious logins based on IP reputation, unusual travel patterns, and leaked credential detection.
• Privileged Identity Management (PIM) prevents permanent admin activation and requires just-in-time elevation.

Key Takeaways

• Standard MFA methods can be defeated through adversary-in-the-middle attacks, push bombing, and SIM swapping.
• Only FIDO2 and passkey authentication offer genuine phishing resistance through domain-specific cryptographic binding.
• Enable Number Matching in Microsoft Authenticator immediately to combat MFA fatigue attacks.
• MFA functions as a single layer within comprehensive security frameworks that must include Conditional Access, EDR, and sign-in risk policies.