Why do passwords and conventional MFA still create phishing risk?

Passwords can be stolen, and many MFA methods still rely on users approving prompts or entering codes that can be captured in real time. Phishing-resistant MFA removes that human handoff by using certificate-based authentication or FIDO passkeys, which deny attackers a reusable secret to harvest.

Why This Matters for Security Teams

Passwords and conventional MFA still leave a phishing path open because the attacker is not trying to “break” authentication so much as reuse what the user willingly supplies in real time. A prompt, code, or one-time approval can be relayed through an adversary-in-the-middle flow and converted into a valid session. That is why NHI Management Group treats phishing resistance as an identity design problem, not a user-awareness problem. The issue shows up repeatedly in incidents such as the Microsoft Midnight Blizzard breach and in broader NHI compromise patterns described in the Ultimate Guide to NHIs — Why NHI Security Matters Now. NIST CSF 2.0 reinforces that identity assurance has to match current threat conditions, not legacy login habits.

In practice, many security teams encounter session theft after a user has already been trained to approve the wrong prompt or surrender a code under pressure, rather than through intentional security testing.

How It Works in Practice

The practical fix is to remove reusable secrets from the phishing path. Passwords can be guessed, reused, or harvested. SMS, email, and push-based MFA can still be phished if the attacker proxies the login and captures the challenge-response flow. Phishing-resistant methods, especially FIDO2 passkeys and certificate-based authentication, bind the login to the real relying party and the user’s device, which means the attacker does not get a transferable secret.

This aligns with the NIST Cybersecurity Framework 2.0 emphasis on stronger identity verification and with the Top 10 NHI Issues research, which shows how excessive privilege and weak credential controls amplify blast radius once an identity is captured. For human identities, the operational pattern is straightforward:

• Prefer FIDO passkeys or certificate-based authentication over OTPs and push approvals.
• Bind authentication to the genuine origin and device, not just to a shared secret or approval event.
• Enforce step-up controls only where the risk engine can evaluate context in real time.
• Retire fallback paths such as SMS or email OTP where phishing resistance is the goal.

The same logic matters for NHI governance because stolen human sessions often become the starting point for tool abuse, secret access, or administrative escalation inside hybrid workflows. Where organisations still depend on code entry or approval fatigue, attackers can proxy the session and defeat the control without ever learning the password. These controls tend to break down in environments with legacy applications that cannot support modern authenticators because fallback methods reintroduce the same phishable factor.

Common Variations and Edge Cases

Tighter authentication often increases rollout complexity, so organisations have to balance phishing resistance against application compatibility, user recovery, and privileged access workflows. Best practice is evolving, but there is no universal standard for every legacy environment yet.

For example, some high-risk administrative paths may still use smart cards, hardware-backed certificates, or device-bound passkeys, while lower-risk applications retain temporary transitional methods. The key distinction is whether the second factor can be relayed or replayed by an attacker. If it can, it is not truly phishing-resistant. This is where guidance in Ultimate Guide to NHIs — Key Challenges and Risks becomes operationally useful: once credentials are treated as reusable assets, compromise spreads quickly across systems, service accounts, and admin pathways.

Security teams should also be careful not to equate “MFA enabled” with “phishing safe.” That is a common reporting mistake. What matters is whether the method resists adversary-in-the-middle attacks, whether recovery paths are equally strong, and whether the organisation can retire weak fallback options without breaking business continuity.

Related resources from NHI Mgmt Group

• Why do conventional MFA methods still leave identity risk on the table?
• When does MFA create enough assurance for high-risk access?
• Why do legacy MFA methods still leave organisations exposed to phishing?
• When does phishing-resistant MFA create more value than traditional MFA?