The MFA you have isn’t the MFA you think you have
Opinion piece argues push and SMS/OTP MFA remain phishable via fatigue attacks, SIM swaps, and real-time proxy kits, urging phased FIDO2/passkey migration.
A CSO Online contributor opinion argues that compliance-reported 'MFA enabled' obscures large differences between push, OTP, and FIDO2 strength, citing Uber's 2022 breach and the MGM Resorts incident as cases where MFA was present but defeated. It details push-fatigue/MFA-bombing, SIM swaps, and reverse-proxy phishing kits that intercept OTPs and hijack sessions in real time. The author recommends a phased migration to origin-bound phishing-resistant passkeys starting with administrator, identity provider, and credential-reset accounts.
- Push fatigue and OTP phishing routinely defeat technically 'enabled' enterprise MFA
- Reverse-proxy phishing kits intercept one-time codes and steal live sessions
- FIDO2 origin-binding kills lookalike-domain phishing by design
- Start passkey rollout with admins, IdP access, and credential-reset accounts
- Organizations
- UberMGM Resorts
From the original article
5 min read at csoonline.com
For nearly a decade, multi-factor authentication has been the control every security leader points to when asked how they’ve reduced account takeover risk.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.