{"id":7358,"date":"2026-08-24T11:57:03","date_gmt":"2026-08-24T11:57:03","guid":{"rendered":"https:\/\/asugoconsulting.com\/?p=7358"},"modified":"2026-08-24T12:05:38","modified_gmt":"2026-08-24T12:05:38","slug":"not-all-mfas-are-created-equal","status":"publish","type":"post","link":"https:\/\/asugoconsulting.com\/fr\/not-all-mfas-are-created-equal\/","title":{"rendered":"Not All MFAs Are Created Equal"},"content":{"rendered":"

Introduction<\/strong><\/h2><\/div>

Multi-factor authentication (MFA) is one of the most widely recommended security controls. And rightly so.<\/p>\n

But having MFA enabled does not necessarily mean your organisation is protected against modern phishing.<\/p>\n

The uncomfortable reality in 2026 is that many MFA methods protecting executives, finance teams and administrators can be bypassed by phishing kits available for a few hundred euros.<\/p>\n

The question is therefore changing from \u201cDo we have MFA?\u201d<\/strong> to \u201cDo we have the right MFA?\u201d<\/strong><\/p>\n<\/div>

How attackers bypass traditional MFA<\/strong><\/h2><\/div>

One of the biggest changes in identity attacks is the rise of Adversary-in-the-Middle (AiTM)<\/strong> phishing.<\/p>\n

Instead of simply creating a fake login page, the attacker places a transparent proxy between the user and the real authentication service.<\/p>\n

The user sees what appears to be the legitimate Microsoft login page, enters a password and approves a push notification or enters an authentication code. The legitimate service then issues a valid session token \u2014 which the attacker captures.<\/p>\n

The password was correct. The MFA was completed. And the account was still compromised.<\/p>\n<\/div><\/div><\/div>

62%<\/strong><\/span><\/p>\n<\/div>

Share of all phishing attempts blocked by Microsoft that were attributable to a single AiTM kit, Tycoon 2FA, by mid-2025<\/em><\/span><\/p>\n<\/div><\/div><\/div>

Taking down one operator does not take down the technique.<\/p>\n<\/div>

<\/span>

The anatomy of an AiTM attack<\/h3><\/div><\/div><\/div>

Three tiers of MFA protection<\/strong><\/h2><\/div>

Not all MFA methods offer the same level of protection. The critical difference is which attack vectors each method is exposed to and whether it can withstand modern phishing techniques such as AiTM attacks<\/strong>.<\/p>\n<\/div>

<\/span>

MFA methods<\/h3><\/div><\/div><\/div>\n
\n\n\n\n\n\n\n\n\n\n\n
Method<\/strong><\/th>\nTier<\/strong><\/th>\nMain attack vectors<\/strong><\/th>\nPhishing resistant?<\/strong><\/th>\n<\/tr>\n<\/thead>\n
Email OTP<\/strong><\/span><\/td>\n\ud83d\udd34 EXPOSED<\/strong><\/td>\nMailbox compromise, forwarding rules, interception and real-time AiTM proxy<\/td>\nNo<\/strong><\/td>\n<\/tr>\n
SMS \/ Voice OTP<\/strong><\/span><\/td>\n\ud83d\udd34 EXPOSED<\/strong><\/td>\nSIM swap, SS7 interception and real-time AiTM proxy<\/td>\nNo<\/strong><\/td>\n<\/tr>\n
TOTP codes<\/strong><\/span><\/td>\n\ud83d\udfe0 BYPASSABLE<\/strong><\/td>\nReal-time AiTM proxy<\/td>\nNo<\/strong><\/td>\n<\/tr>\n
Hardware OTP tokens<\/strong><\/span><\/td>\n\ud83d\udfe0 BYPASSABLE<\/strong><\/td>\nReal-time AiTM proxy; the user still retypes a code<\/td>\nNo<\/strong><\/td>\n<\/tr>\n
Push notifications<\/strong><\/span><\/td>\n\ud83d\udfe0 BYPASSABLE<\/strong><\/td>\nMFA fatigue and real-time AiTM proxy<\/td>\nNo<\/strong><\/td>\n<\/tr>\n
FIDO2 passkeys, Windows Hello for Business, smart cards and certificate-based authentication<\/strong><\/span><\/td>\n\ud83d\udfe2 PHISHING RESISTANT<\/strong><\/td>\nOrigin-bound authentication. Residual risks include token theft, enrolment abuse and endpoint compromise<\/td>\nYes<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

The key distinction is architectural. Email and SMS are exposed<\/strong> because they can be intercepted remotely. TOTP, hardware tokens and push notifications are stronger<\/strong>, but can still be relayed through an AiTM proxy. Number matching helps prevent MFA fatigue, but does not stop this type of attack.<\/p>\n

Phishing-resistant methods work differently.<\/strong> Passkeys, Windows Hello and certificate-based authentication bind the authentication to the legitimate service, leaving no reusable code for an attacker to intercept and relay.<\/p>\n

That is the difference between simply having MFA<\/strong> and having MFA that can resist modern phishing attacks<\/strong>.<\/p>\n<\/div>

And what about Europe?<\/strong><\/h2><\/div>

For European organisations, compliance does not necessarily mean phishing-resistant<\/strong>:<\/p>\n