Two-factor authentication has spent years being promoted as one of the simplest ways to protect an online account. A password might be stolen, but the attacker would still need a second factor. That extra barrier was supposed to make account takeover dramatically harder.
The problem is that cybercriminals have adapted.
A technique known as adversary-in-the-middle phishing, often shortened to AiTM, can intercept a victim’s login process in real time. Instead of merely stealing a password, the attacker can capture authentication information and, in some cases, the session cookie created after the victim successfully completes two-factor authentication.
Microsoft has documented attacks in which AiTM phishing sites stole passwords and hijacked authenticated sessions even when victims had enabled multifactor authentication. (microsoft.com)
Does that mean two-factor authentication is useless?
No. But it does mean that not every form of 2FA provides the same level of protection anymore.
Traditional Phishing Used to Be Much Simpler
Classic phishing attacks usually relied on imitation.
A victim might receive an email that appeared to come from a bank, Microsoft, Google, or another trusted organization. The email would contain a link leading to a fake login page.
The victim entered a username and password.
The attacker collected them.
Two-factor authentication complicated this attack because possession of the password was no longer enough. The criminal also needed the temporary security code, mobile approval, or another second factor.
So attackers changed their strategy.
Instead of creating a static copy of the login page, modern AiTM phishing infrastructure can act as a proxy between the victim and the legitimate website.
That difference is critical.
Microsoft describes AiTM attacks as positioning the attacker between the user and the legitimate authentication service so credentials and MFA responses can be intercepted. The objective is often to obtain the session cookie created after authentication succeeds. (microsoft.com)
The attacker is no longer simply asking, “What is the password?”
They are trying to hijack the successful login itself.
How Adversary-in-the-Middle Phishing Works
Imagine someone receives what appears to be a legitimate Microsoft 365 login link.
The page looks correct.
The Microsoft logo appears where expected. The login form behaves normally. The user enters an email address and password.
Behind the scenes, however, the fake website is forwarding that information to the real Microsoft authentication service.
Microsoft asks for the second factor.
The victim receives the expected authentication request and approves it.
Everything appears normal.
The legitimate service now creates an authenticated session and sends back a session token or cookie.
The phishing proxy can intercept that information before forwarding the normal webpage back to the victim.
Now the attacker potentially possesses something more useful than the 2FA code.
They possess an already authenticated session.
Microsoft’s current token-theft guidance specifically identifies AiTM phishing kits as one possible starting point for attacks involving stolen authentication tokens. (microsoft.com)
Why the Session Cookie Matters So Much
Websites do not normally ask users to enter their password and 2FA code every time they click another page.
After authentication succeeds, the service creates a session.
A browser receives a token or cookie proving that authentication has already occurred. As long as that session remains valid, the website recognizes the browser as an authenticated user.
This improves usability.
It also creates an attractive target.
If an attacker steals a usable session token, they may not need to repeat the original authentication process immediately. The server sees a valid authenticated session rather than another person attempting to enter the account.
This is why simply adding another temporary numeric code does not always solve the problem.
The attacker may not be defeating the mathematics behind the code.
They are manipulating the login workflow so the real user completes authentication for them.
SMS Codes Are Especially Limited
SMS-based two-factor authentication is still considerably better than using only a password, but it has several weaknesses.
Text messages can potentially be exposed through SIM-swapping attacks, social engineering, compromised carrier accounts, malware, or phishing.
More importantly, an SMS code can still be typed into a convincing phishing page.
If the criminal controls a live proxy between the victim and legitimate login service, that temporary code may be relayed immediately.
The same fundamental limitation affects many one-time-password authenticator codes.
NIST’s current digital identity guidance explicitly distinguishes phishing-resistant authentication from methods that depend on codes users can manually transfer between devices or websites. It states that out-of-band authentication is not inherently phishing-resistant. (nist.gov)
The critical word is phishing-resistant.
That is increasingly becoming more important than simply saying an account has “2FA.”
Authenticator Apps Are Better, but Not Automatically Phishing-Proof
Authenticator applications generating time-based one-time passwords usually provide stronger security than SMS because an attacker cannot simply hijack the victim’s phone number.
However, the code itself can still be phished.
A fraudulent website can ask for the six-digit code immediately after collecting the password. The attacker can relay it to the legitimate service before it expires.
Push notifications can also be abused.
Some attackers repeatedly send authentication requests until a distracted or frustrated user eventually approves one. This technique is sometimes called MFA fatigue or push bombing.
That does not make authenticator apps ineffective.
It simply demonstrates why modern account security increasingly needs authentication methods that cannot be transferred to the wrong website at all.
Passkeys Change the Security Model
Passkeys are one of the most important developments addressing this problem.
Unlike passwords or manually entered one-time codes, passkeys use public-key cryptography and are tied to the legitimate website or application.
Google explains that passkeys are phishing-resistant because they work only with the website or app for which they were registered. A deceptive website cannot simply ask a user to reveal the underlying private credential. (google.com)
That creates a major difference.
With a traditional 2FA code, the user sees six digits and can accidentally type those digits anywhere.
With a passkey, the authentication system verifies the website identity cryptographically.
A phishing site using a similar-looking domain cannot simply capture the passkey and replay it somewhere else.
Hardware Security Keys Offer Similar Protection
Physical security keys using standards such as FIDO2 and WebAuthn provide another strong defense.
A user inserts or taps the security key during authentication, but the device verifies the legitimate site’s cryptographic identity before completing the login.
Google describes its Titan Security Key as a phishing-resistant second factor built around FIDO standards.
CISA has also repeatedly recommended phishing-resistant authentication, particularly for sensitive and privileged accounts. Its guidance places hardware-based FIDO/WebAuthn authentication among the strongest MFA options. (cisa.gov)
This represents an important change in cybersecurity thinking.
The goal is no longer simply to ask users for two things.
The goal is to make those authentication factors useless to an attacker even if the user is tricked.
Why Organizations Are Moving Toward Phishing-Resistant MFA
The distinction between traditional MFA and phishing-resistant MFA has become significant enough that NIST now requires phishing-resistant authentication for certain federal information-system scenarios.
Its current Digital Identity Guidelines state that phishing-resistant authentication should be offered at higher assurance levels and required for federal staff, contractors, and partners accessing federal systems. (nist.gov)
Why such a strong requirement?
Because humans will always make mistakes.
A perfectly designed fake login page can be extremely difficult to identify. Attackers can copy logos, fonts, authentication pages, CAPTCHA screens, and even portions of legitimate URLs.
Microsoft reported in 2026 that attackers were continuing to use proxy-based AiTM phishing frameworks capable of intercepting credentials and session cookies. (microsoft.com)
The security industry therefore cannot rely entirely on users noticing every fraudulent webpage.
Authentication technology itself needs to recognize the difference.
Two-Factor Authentication Is Still Worth Using
The headline may sound alarming, but abandoning 2FA would make security worse.
Even conventional two-factor authentication blocks many attacks involving stolen or reused passwords.
An attacker who buys a password from a breach database may still be unable to access the corresponding account because the second factor stops them.
The weakness emerges primarily when the attacker actively manipulates the authentication process.
That means the better conclusion is not that 2FA has failed.
It is that 2FA is evolving.
SMS verification is better than a password alone. Authenticator apps generally improve protection further. Phishing-resistant passkeys and hardware security keys can provide significantly stronger defenses against modern credential-interception attacks.
The Next Security Question Is Not “Do You Have 2FA?”
For years, the security advice was easy.
Enable two-factor authentication.
That advice remains valid, but it is no longer complete.
The more useful question now is: what kind of two-factor authentication is protecting the account?
Attackers have learned how to place themselves inside the login process, relay credentials in real time, and steal sessions after users successfully authenticate.
Traditional MFA raises the barrier, but sophisticated phishing can sometimes move around it.
Passkeys, FIDO2 security keys, WebAuthn, and other phishing-resistant methods change that equation by making authentication dependent on the legitimate website itself rather than something a human can unknowingly hand to an attacker.
Two-factor authentication is therefore not dead.
But the era when any second factor could automatically be considered strong security is rapidly disappearing.
