TL;DR: Phishing remains a dominant attack path, with 83% of organisations reporting attacks in 2021 and many traditional MFA schemes still vulnerable to SIM swapping and man-in-the-middle interception, according to Axiad. Phishing-resistant MFA changes the control assumption by removing easily phished one-time codes and pushing authentication toward cryptographic proof instead of reusable secrets.
At a glance
What this is: This is a 2022 Axiad blog post arguing that phishing-resistant MFA is the practical response to credential theft because traditional OTP-based MFA still leaves room for interception and phishing.
Why it matters: It matters to IAM teams because authentication controls that can be phished still leave users, contractors, and partner access exposed even when MFA is technically enabled.
By the numbers:
- 15 billion spam emails are sent across the internet each day.
- 83% of organizations reported phishing attacks in 2021.
Context
Phishing-resistant MFA is about making authentication proof resistant to interception, replay, and lookalike login pages. In identity terms, the problem is not whether MFA exists, but whether the second factor can still be captured and reused by an attacker.
For IAM teams, that distinction matters because OTP-based MFA still depends on secrets or codes that users can be tricked into revealing. Once credentials or verification codes can be phished, the control no longer breaks the attack path cleanly; it only slows it down.
This article is best read as an authentication-control argument for human IAM, with clear implications for privileged users, contractors, and partner access.
Key questions
Q: What breaks when MFA still depends on codes that users can type into a fake login page?
A: The control breaks at the point where the factor can be intercepted, copied, and replayed by an attacker. That means the login flow still trusts a transferable secret, so the user can be phished even though MFA is technically present. In practice, the issue is not missing MFA, but MFA that remains usable by the attacker.
A: They bind the login event to a cryptographic device and the correct origin, so the attacker cannot simply relay a code through a lookalike page. OTP-based MFA still depends on a secret the user can reveal or redirect, while phishing-resistant MFA makes interception materially less useful.
Q: How should security teams decide where to deploy phishing-resistant MFA first?
A: Start with the accounts and workflows that create the greatest blast radius if compromised, including privileged access, sensitive data access, and business-critical approvals. That sequencing gives the most risk reduction for the least disruption. The goal is to protect the paths an attacker is most likely to target, not just increase MFA coverage everywhere.
A: It should be treated as an authentication policy decision within zero trust, not as a cosmetic MFA upgrade. Zero trust assumes continuous verification and reduced trust in the login event, which makes replay-resistant authenticators a more defensible baseline for high-value access paths.
Technical breakdown
Why OTP-based MFA still fails against phishing
Traditional MFA often combines a password with an additional factor such as an SMS code, email link, or one-time password. The security gain comes from requiring more than a password, but the factor can still be intercepted, replayed, or captured through social engineering. In man-in-the-middle attacks, a fake login page can proxy the real authentication flow and harvest both credentials and the MFA response. In SIM-swapping attacks, the attacker diverts the phone number and receives the verification code directly. The weakness is not that MFA is absent, but that the second factor remains phishable.
Practical implication: Treat any MFA design that relies on reusable or interceptable codes as phishable unless cryptographic proof is built into the authentication flow.
How phishing-resistant MFA changes the trust model
Phishing-resistant MFA uses cryptographic authenticators such as FIDO2/WebAuthn or PIV smart cards instead of one-time passwords. The device proves possession of a private key bound to the login origin, which means a fake site cannot simply relay the credential and complete authentication. This is a different control model from OTP-based MFA because the user is not transcribing a secret that can be copied. The authentication event becomes origin-bound and far harder to replay. That shifts the focus from recovering stolen codes to preventing credential replay in the first place.
Practical implication: Prioritise origin-bound cryptographic authenticators for users whose accounts would be high value if phished.
Why phishing-resistant MFA is now an access governance issue
Once authentication can be phished, the remaining risk is not just account takeover but downstream privilege abuse, especially where the user is a privileged employee or trusted partner. Phishing-resistant MFA narrows that window by making credential capture materially harder, which is why it fits broader zero-trust and passwordless strategies. For governance teams, the point is not simply to modernise sign-in. It is to remove authentication paths that still rely on human error tolerance. If a control can be defeated by a convincing prompt, it is not yet a durable identity control.
Practical implication: Use phishing resistance as a policy requirement for sensitive accounts instead of treating it as an optional enhancement.
Threat narrative
Attacker objective: Steal valid credentials and MFA responses to impersonate the user and gain access to protected resources.
- Entry begins with phishing delivery through spam, lookalike login pages, or social engineering that directs the user into an attacker-controlled authentication flow.
- Credential harvesting follows when the user enters a password and an interceptable second factor such as an SMS code or email OTP.
- Escalation occurs when the attacker reuses the captured credentials to log in as the victim and reach protected applications or administrative pathways.
- Impact is account takeover, which can lead to further fraud, data access, or ransomware deployment from a trusted identity.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing-resistant MFA is a control-design response to credential theft, not a user-training substitute. Traditional MFA assumes the second factor can withstand interception long enough to matter. Once attackers can relay or redirect the factor, the control becomes a delay mechanism rather than a barrier, and the governance question shifts to which authenticators are still phishable.
OTP-based MFA creates a trust gap between possession and proof. SMS codes, email codes, and similar shared secrets can be copied or forwarded, which means the authenticator is still transferable in practice. That is why phishing-resistant methods matter: they bind the login event to a cryptographic device and reduce the value of stolen secrets.
Identity programmes need to classify authentication methods by replay resistance, not by MFA label. A policy that treats every second factor as equivalent collapses the real risk difference between a cryptographic authenticator and an interceptable code. Practitioner teams should measure whether the authentication method can survive adversary-in-the-middle conditions, because that is where many MFA deployments fail.
Phishing-resistant MFA should be treated as baseline control for high-value human identities. Privileged users, administrators, and trusted partner accounts are too consequential to protect with authentication methods that can be proxied through a fake site. The governance standard should be origin-bound proof, not just additional friction.
Human identity controls are still the front line for non-human impact. When attackers compromise a person’s access, they often inherit service consoles, admin portals, and delegated operational rights behind that person. Stronger authentication for human users therefore reduces risk across the broader access chain, including machine and partner touchpoints that depend on those identities.
From our research library:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
- Read next: Passwordless and Passkeys Guide
What this signals
Phishing-resistant MFA raises the bar by changing what the attacker has to steal. When the second factor is cryptographic and origin-bound, fake login pages and redirected codes lose much of their value. That is why authentication policy should distinguish between phishable MFA and replay-resistant MFA instead of treating them as equivalents.
Authentication controls now sit at the junction of human IAM and broader identity risk. A compromised human account is often the gateway into privileged consoles, SaaS administration, and delegated access chains. Teams that still allow interceptable factors for sensitive roles are accepting avoidable replay risk in the part of the stack most likely to be targeted.
Phishing-resistant MFA should be the default for high-value access paths. The practical test is simple: if an attacker can reuse what the user entered, the authenticator is still too weak for sensitive identity flows. Policy needs to be written around replay resistance, not vendor labels.
For practitioners
- Prioritise phishing-resistant authenticators for privileged users Move administrators, help desk staff, and remote access users to FIDO2/WebAuthn or PIV-backed sign-in first, because their accounts create the highest downstream blast radius.
- Retire interceptable OTP flows for sensitive access Remove SMS, email codes, and other replayable factors from the login paths that protect crown-jewel applications, partner portals, and privileged consoles.
- Classify MFA methods by phishing resistance Document which authenticators can survive fake-login relay attacks, then set policy so high-risk roles are only allowed cryptographic proof factors.
- Align access policy to zero-trust authentication Treat phishing-resistant MFA as part of conditional access and zero trust design, not as a standalone user convenience choice.
Key takeaways
- Phishing-resistant MFA matters because traditional OTP-style factors can still be intercepted, replayed, or proxied through fake login pages.
- The article ties phishing to stolen credentials, account takeover, and downstream ransomware risk, which makes authentication design a frontline security decision.
- For sensitive users and partner access, cryptographic authenticators such as FIDO2/WebAuthn or PIV are the control class that changes the attacker's economics.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63B — Authentication | The article centres on authentication strength and phishing-resistant sign-in methods. |
| Recommendation — Use SP 800-63B to define which authenticators are acceptable for high-risk access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Phishing-resistant MFA supports stronger authentication for access decisions. |
| Recommendation — Apply PR.AA-05 to enforce stronger authentication on sensitive identity flows. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The post addresses authentication methods that can still be phished and replayed. |
| NHI-10 — Human Use of NHI | The article touches broader identity controls that protect human users from credential theft. | |
| Recommendation — Replace phishable second factors with replay-resistant authenticators where identity assurance matters most. Separate human sign-in controls from reusable secrets that attackers can co-opt. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The core threat is stealing credentials and MFA responses through phishing. |
| Recommendation — Map phishing and OTP theft to TA0006 and prioritise controls that block credential capture. | ||
Key terms
- Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
- One-Time Password: A one-time password is a short-lived authentication code used once, then discarded. It usually supplements a primary password as a second factor, but its security depends heavily on how the code is generated, delivered, and recovered if the user loses access.
- Origin-bound authentication: An authentication method that only works for the intended website, application, or relying party. This reduces the value of phishing pages and proxy attacks because the factor cannot be easily replayed against a different destination.
- Replay resistance: The degree to which an authentication factor or session token cannot be captured and reused by an attacker. Replay resistance is a practical test of MFA quality because a control that can be proxied or forwarded may look strong while still failing under phishing or man-in-the-middle abuse.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org