Topic starter
11/07/2026 8:41 pm
TL;DR: Legacy MFA models built for 2015-era threats are increasingly vulnerable to MFA fatigue, reverse-proxy phishing, token theft, SIM swaps, OTP interception, and AI-driven social engineering, according to eMudhra. The security problem is no longer authentication alone, but whether trust is cryptographically anchored enough to survive modern deception and session abuse.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Will Your MFA Service Cut It in 2026? Real MFA Looks Like This”.
Key questions
Q: What breaks when organisations keep approval-based MFA for 2026 threats?
A: Approval-based MFA breaks when attackers can manipulate the user, intercept the code or replay the session after the factor has been accepted.
Q: Why do push prompts and OTPs create so much identity risk?
A: They create risk because they depend on a user action that attackers can influence through fatigue, phishing or real-time relay.
Q: How should security teams decide where to deploy phishing-resistant MFA first?
A: Start with the accounts and workflows that create the greatest blast radius if compromised, including privileged access, sensitive data access, and business-critical approvals.
Practitioner guidance
- Replace approval-based MFA on critical access paths Move administrator, finance and privileged application access away from push prompts and SMS codes toward phishing-resistant methods such as FIDO2 security keys, certificate-based authentication or device-bound passkeys.
- Extend authentication governance to machine identities Review service accounts, workload identities and API access paths for weak or reusable credentials, especially where the same trust model is still applied to humans and non-human actors.
- Add session-level verification to Zero Trust policies Require contextual checks on high-risk actions, not just at login, so stolen cookies, replayed tokens and fatigued approvals do not remain trusted for the rest of the session.
Bottom line: Weak MFA is failing because attackers now target the approval path, session material and user judgement rather than the password alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:11 pm
Weak MFA is now a trust-design failure, not a factor-counting problem. The article is right to separate modern compromise paths from legacy second-factor thinking. Push approvals, SMS codes and user-visible prompts are no longer reliable evidence of identity assurance when attackers can spoof, intercept or fatigue the response. The practitioner conclusion is that MFA design must be judged by resistance to interception and manipulation, not by the mere presence of a second factor.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should identity programmes cover machine accounts and workloads?
A: Identity programmes should govern machine accounts with the same seriousness as human access, but through device, certificate and secret lifecycle controls rather than prompts and approvals. Service accounts, APIs and workloads need inventory, ownership, authentication scope and revocation paths because weak machine identity often becomes the route around strong human MFA.
👉 Read our full editorial: Why weak MFA is failing against 2026 attack techniques