OTP-based MFA can still be relayed because the code is reusable for the brief window it is valid, so a proxy attacker can pass it through to the legitimate service. Phishing resistant authentication binds the proof to the real origin and the device or key, which prevents simple replay through a fake login page.
Why the Difference Matters in an AitM Attack
In an adversary-in-the-middle attack, the attacker is not trying to guess the factor, they are trying to sit between the user and the service and reuse the user’s proof in real time. OTP-based MFA mainly proves that someone saw a current code, which is enough for a proxy to relay it. phishing resistant authentication raises the bar by binding the ceremony to the real origin and a trusted device or key, so the proxy cannot simply forward the proof.
The practical distinction is that OTP protects against password-only compromise, but not necessarily against live interception of the login flow. That is why modern guidance treats phishing resistance as a stronger control for remote access and high-value accounts, especially where credential phishing and session capture are realistic threats.
How OTP Relaying Works Versus Bound Authentication
OTP factors are usually time-limited and one-time in name, but they are still bearer-like during their validity window. If a user enters the code into a fake login page, the attacker can forward it to the legitimate service before expiry and complete the sign-in. The user sees a familiar prompt, but the attacker has effectively inserted a relay channel into the authentication ceremony.
Phishing resistant methods change the trust model. FIDO2, WebAuthn, and similar authenticators verify the site context and use cryptographic proof tied to the legitimate relying party, which means the response is not reusable at an attacker-controlled origin. That binding removes the simple relay path that makes AitM attacks work against OTP.
For a broader identity perspective, this is the same difference described in NIST SP 800-63 Digital Identity Guidelines, which distinguishes authenticators that resist phishing from those that can be replayed through an intermediary.
Risk and Threat Considerations
AitM attacks are especially effective when the defender assumes MFA alone is enough. The weakness is not the factor itself, but the fact that OTP verification can be intercepted and forwarded while the session is still valid. Once the attacker obtains a live session, they may bypass later prompts, pivot to mail or admin tools, and widen access without ever needing to learn the underlying password.
Failure mechanism: The login flow is proxied in real time, so the attacker relays the password and OTP, then steals the authenticated session or token after the service accepts the relayed proof.
Impact: The account may appear protected by MFA while still being vulnerable to takeover, downstream data access, privilege abuse, and follow-on compromise of connected systems.
Recent breach reporting shows why this matters in practice. In incidents such as Uber Breach and Microsoft Midnight Blizzard breach, attackers exploited authentication weaknesses or social engineering paths to reach internal resources, illustrating that the real risk is often session capture and access persistence rather than simple password theft alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Phishing Resistance — Phishing Resistance | Directly distinguishes OTP from origin-bound authenticators in AitM scenarios. |
| Recommendation — Prefer phishing-resistant authenticators for accounts exposed to real-time relay attacks. | ||
| NIST Zero Trust (SP 800-207) | AC-3 — Session-Scoped Access Enforcement | AitM often converts authentication compromise into session misuse requiring continuous verification. |
| Recommendation — Enforce continuous access checks so a captured login does not automatically preserve trust. | ||
| CIS Controls v8 | 6.3 — Require MFA for Externally-Exposed Applications | Externally exposed login surfaces are the common entry point for phishing and relay attacks. |
| Recommendation — Require MFA on exposed services and prefer stronger factors where phishing is likely. | ||
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | The question is explicitly about the relay technique attackers use to intercept authentication. |
| Recommendation — Map detections and hardening to AitM relay behavior and session theft indicators. | ||
Practitioner Guidance
What to verify: Treat “MFA enabled” as an incomplete control statement unless you know whether the factor is phishing resistant. For remote administration, privileged users, and sensitive SaaS access, verify that the method is origin-bound and not just code-based.
What to prioritise: Migrate highest-risk populations first, especially anyone whose compromise would expose email, finance, cloud consoles, or admin tooling. OTP can remain a transitional control, but it should not be the endpoint for accounts most likely to be targeted by AitM.
Practitioner takeaway: The deciding question is not whether MFA exists, but whether the proof can be replayed through a fake site. If it can, the control still leaves an AitM gap; if it is origin-bound, the attacker loses the simplest relay path.
Related resources from NHI Mgmt Group
- What is the difference between push-based MFA and phishing-resistant authentication?
- What is the difference between phishing-resistant MFA and traditional password-based authentication in government identity programs?
- What is the difference between certificate-based authentication and FIDO passkeys for phishing-resistant MFA?
- What is the difference between phishing-resistant MFA and Just-in-Time access in browser-based attack defence?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
