The Authentication Problem in 2026
Organizations that deployed TOTP-based MFA in 2020β2022 made a meaningful security improvement. But the threat landscape has evolved faster than their authentication controls. Real-time adversary-in-the-middle (AiTM) phishing frameworks have made standard MFA bypass a commoditized attack β available to moderately skilled attackers, sold as-a-service on criminal forums for as little as $200/month.
CISA’s 2025 advisory is explicit: SMS OTP and TOTP authenticators “do not protect against sophisticated phishing attacks.” For high-risk environments, the question is no longer “should we implement MFA?” β it’s “which MFA implementation is adequate for our threat model?”
How Standard MFA Gets Bypassed
Adversary-in-the-Middle (AiTM) Phishing
AiTM frameworks (Evilginx, Modlishka) use reverse-proxy to intercept both credentials and MFA tokens in real time:
- Victim receives phishing link to attacker-controlled domain (visually identical to real login)
- Victim enters credentials β forwarded to real authentication service
- Real service sends MFA challenge β attacker’s proxy displays it to victim
- Victim completes MFA β token forwarded to real service
- Real service issues session cookie β attacker’s proxy captures it
- Attacker uses session cookie without triggering further authentication
The attack is nearly transparent. Standard MFA provides zero protection β the entire authentication flow completes normally through the attacker’s proxy.
MFA Fatigue (Push Bombing)
Attackers with stolen credentials repeatedly initiate authentication, triggering push notifications until an exhausted or confused user approves one. This technique successfully compromised Uber (2022) and Cisco (2022). Mitigation: implement number matching in push apps β users must enter a number displayed in the login prompt, not just tap approve.
Phishing-Resistant MFA: The Required Upgrade
FIDO2 Hardware Security Keys
FIDO2 hardware keys (YubiKey, Google Titan) generate cryptographic signatures bound to the specific authentication origin (domain). If the request comes from a phishing domain, the signature fails β authentication is denied even if the user cooperates. The phishing proxy cannot relay this because the cryptographic binding fails on the real server.
Implementation: Require minimum 2 keys per user (one primary, one backup). Keys: $25β$90+. Support in Microsoft Entra ID, Okta, Google Workspace, Duo.
Passkeys
Passkeys are FIDO2 credentials stored in device secure hardware (Apple Secure Enclave, Android hardware keystore, Windows Hello TPM). Same phishing-resistant properties as hardware keys but built into devices β no additional hardware required. Authentication via Face ID, Touch ID, or Windows Hello biometrics.
Support (2026): Apple (iOS 16+, macOS Ventura+), Google (Android 9+), Microsoft (Windows 11 Hello), and most major services: Google, Apple, Microsoft, GitHub, PayPal, Adobe, Shopify.
Conditional Access: Risk-Based Authentication
Conditional access policies (Microsoft Entra ID, Okta, Google BeyondCorp) evaluate authentication risk signals and apply different requirements based on risk level:
- Low risk (known device, expected location): standard passkey or MFA
- Medium risk (new device, unusual location): step-up to hardware key
- High risk (suspicious IP, impossible travel, compromised credential signal): block or force strongest-assurance authentication
Priority Conditional Access Policies
- Require compliant device for all sensitive applications
- Require phishing-resistant MFA for all admin accounts β non-negotiable
- Block legacy authentication protocols (Exchange ActiveSync, IMAP, POP3)
- Implement impossible travel detection with automatic blocking
MFA Requirements by Account Type
| Account Type | Minimum Requirement | Recommended |
|---|---|---|
| Standard employees | TOTP authenticator app | Passkeys on enrolled device |
| Remote/hybrid workers | Push MFA with number matching | Passkeys + device compliance |
| Privileged/admin accounts | FIDO2 hardware key | Hardware key + PAW + JIT access |
| Service accounts/APIs | Certificate-based + IP allowlisting | Workload identity + zero-standing access |
| Contractors/third-party | TOTP minimum | JIT access with expiration |
Zero Trust Identity Architecture
True zero trust goes beyond strong login authentication to continuous verification:
- Phishing-resistant MFA (FIDO2/passkeys) for initial authentication
- Device compliance check (MDM enrollment verified at each access request)
- Short-lived access tokens (minutes/hours, not days)
- Privileged Access Workstations (PAWs) for admin operations
- Just-in-time (JIT) access for elevated privileges
- Network segmentation β authenticated identity doesn’t grant broad network access
Conclusion
The MFA upgrade path is clear: standard TOTP and push notification MFA β phishing-resistant FIDO2/passkeys, with conditional access policies applying risk-based authentication across the environment. The investment is non-trivial but the risk reduction is measurable: AiTM phishing and push bombing β two of the most common enterprise initial access techniques in 2026 β are rendered ineffective by phishing-resistant MFA. For high-risk environments, this is the minimum credible defense against the actual threat landscape.
API Security in 2026: Protecting the Interface Layer That Runs Modern Business
APIs have become the backbone of modern business. Every mobile app, cloud service, third-party integration,β¦
Read More β
Incident Response Planning: The Playbook Every Business Needs Before an Attack
The question is no longer whether your organization will face a cyberattack. It’s whether you’llβ¦
Read More β
GDPR, CCPA, and Global Privacy Compliance: The 2026 Business Guide
Global privacy regulation has fundamentally transformed how businesses collect, process, store, and share personal data.β¦
Read More β-
By Guy Sheetrit
- Jul 8, 2026
By Guy Sheetrit
