Topic starter
12/06/2026 12:30 am
TL;DR: Attackers are increasingly bypassing phishing-resistant authentication by downgrading users to backup MFA methods inside attacker-in-the-middle phishing flows, according to Push Security. Passwordless helps, but it does not remove the governance problem created by multiple active login paths and inconsistent app-level controls.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “MFA downgrade: How attackers are getting around phishing-resistant authentication”.
Key questions
Q: What breaks when backup MFA methods remain active after passkey rollout?
A: The strongest login method stops being the effective control if users can still be pushed onto a weaker fallback.
Q: Why do passwordless programmes still need conditional access and app-level policy?
A: Passwordless reduces phishing exposure, but it does not guarantee that every app enforces the same login rules.
Q: How can security teams tell whether MFA downgrade risk is still present?
A: Look for accounts that have more than one active sign-in method, especially where the weaker option can still be chosen during login.
Practitioner guidance
- Remove backup login paths Delete unused passwords, recovery codes, SMS factors, and alternate authentication methods wherever the business app allows it, so phishing-resistant methods are no longer bypassable through a weaker fallback.
- Enforce phishing-resistant MFA on core IdP accounts Require passkey or equivalent phishing-resistant authentication on the primary identity provider account that governs access to business applications, and block weaker methods where policy support exists.
- Review app-level authentication defaults Check whether each business application allows method selection, fallback promotion, or local overrides that can defeat the strongest available login method.
Bottom line: MFA downgrade attacks succeed because an account still has a weaker login path that the attacker can steer the user toward.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 9:46 am
Backup authentication is now the real weak point in many passwordless programmes. The security promise of passkeys depends on weak alternatives being removed, not merely hidden behind a better default. When SMS, OTP, passwords, or recovery flows remain active, the attacker targets the path of least resistance rather than the primary factor. Practitioners should treat fallback methods as first-class governance objects, not temporary migration artefacts.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should organisations do when an app does not support the preferred authentication policy?
A: Treat the app as an exception that needs compensating controls, not as a reason to accept weaker login behaviour. Restrict access paths where possible, remove redundant credentials, and document the residual exposure so the application cannot silently undermine the broader identity programme.
👉 Read our full editorial: MFA downgrade attacks expose the limits of passwordless rollouts