Should organisations rely on MFA alone against AITM phishing?

Why This Matters for Security Teams

aitm phishing changes the value of MFA from “stop the login” to “delay the attacker.” A user can approve a prompt, enter a one-time code, or complete a passkey flow inside a malicious proxy, and the attacker may still capture the authenticated session. That makes session binding, login-context validation, and post-authentication containment more important than the factor itself. NIST Cybersecurity Framework 2.0 frames this as a broader identity assurance and access control problem, not just a point-in-time authentication problem.

The operational risk is that defenders often measure success by whether MFA was enforced, while attackers measure success by whether a session cookie or token was minted. NHIMG’s analysis of the Microsoft Midnight Blizzard breach underscores how identity compromise can outlive the initial login event, especially when downstream access is not tightly constrained. A second concern is that AITM phishing often exploits weak user-context checks, making it easier to reuse a fresh session from a different device, network, or geography. In practice, many security teams discover this after token replay or mailbox takeover has already occurred, rather than through intentional validation of authentication boundaries.

How It Works in Practice

Organisations that want to reduce AITM exposure need layered controls that treat MFA as one signal, not the control plane. At a minimum, that means phishing-resistant authentication, session binding, conditional access, and strict limits on what a newly issued session can do. NIST guidance on identity assurance and the NIST Cybersecurity Framework 2.0 both support this shift toward stronger access decisions based on context, not just successful factor completion.

Practical controls usually include:

• Phishing-resistant MFA such as FIDO2 or passkeys, with careful attention to device enrollment and recovery paths.
• Session theft detection, including token replay checks, impossible-travel signals, and browser or device fingerprint anomalies.
• Short session lifetimes and reauthentication for sensitive actions, especially for email, admin portals, and finance systems.
• Conditional access rules that inspect device health, location, risk score, and authentication freshness before granting scope.
• Post-login containment such as least privilege, step-up checks, and separate approval for high-risk transactions.

NHIMG’s DeepSeek breach coverage is a useful reminder that identity compromise is often paired with broader exposure of credentials and tokens, which is why static trust in a single successful login is unsafe. Current guidance suggests pairing MFA with runtime context checks and session-level enforcement, because the real failure mode is not password theft alone but the creation and reuse of a valid authenticated session. These controls tend to break down in legacy web apps and remote access stacks that cannot bind sessions to device state or continuously evaluate risk after login because the session itself remains portable.

Common Variations and Edge Cases

Tighter access controls often increase friction for users and support teams, requiring organisations to balance phishing resistance against operational overhead. That tradeoff is real, especially where contractors, BYOD devices, or high-volume customer support workflows make strict device binding harder to deploy.

There is no universal standard for how much session risk scoring is enough, so best practice is evolving. For high-risk roles, MFA alone is especially weak if the attacker can proxy the session, exfiltrate cookies, or abuse long-lived refresh tokens. For lower-risk SaaS use cases, organisations may accept shorter session lifetimes and stronger anomaly detection rather than continuous challenge prompts. The important distinction is that MFA proves a factor was satisfied, but it does not prove the session is trustworthy after authentication. That is why control sets should extend to browser hardening, conditional access, and rapid revocation when a login looks suspicious. NHIMG’s research on the Microsoft Midnight Blizzard breach shows how attacker persistence can survive the initial authentication event when downstream session governance is weak.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on MFA alone for digital interactions?
• Why do phishing-resistant MFA controls still fail against social engineering?
• How should organisations reduce MFA compromise from real-time phishing?
• Should organisations rely on detection alone for secrets management?