Phishing-as-a-Service Is Beating Weak MFA

The phishing email that finally works on your team will not have typos. The landing page will not be a clumsy copy. In the current generation of attacks, the page your engineer sees often is the real login page, relayed through a proxy the attacker controls. The password is real. The MFA prompt is real. The approval is real. The only fake thing in the entire flow is who ends up holding the session cookie at the end of it.

That is the part most awareness training never covers, because for years we taught people to look for bad spelling and wrong domains. The kits moved on.

The kit does the hard work now

Phishing-as-a-service means an attacker with no particular skill rents everything: convincing infrastructure, TLS certificates, hosting that rotates faster than blocklists, dashboards showing captured sessions in real time, and documented playbooks. The interesting kits are built around a handful of techniques.

Adversary-in-the-middle proxying relays the victim's real login session and captures the authenticated cookie on the way through. OAuth consent abuse skips credentials entirely and asks the victim to authorize an application that then reads their mailbox forever. Device code phishing walks the victim through entering a short code on a completely legitimate vendor page, quietly granting the attacker a session. And MFA fatigue just sends push prompts until a tired human presses approve to make the phone stop.

Notice what these have in common. In every case the victim interacts with something genuine. The controls that depend on the user spotting a fake have already lost.

Your MFA is probably the weak kind

This is the uncomfortable audit. SMS codes, one time passwords typed into a page, and simple push approvals all share the same flaw: nothing binds the second factor to the site the user is actually talking to. A proxy can relay all of them.

Passkeys and other WebAuthn credentials are different in kind, not degree. The cryptographic exchange includes the origin, so a credential registered to your real domain simply will not complete a login through the attacker's look-alike proxy. There is no judgment call for the user to get wrong at 5pm on a Friday.

You do not have to move everyone in a quarter. Move your administrators first. A tenant where every privileged account requires phishing resistant MFA is a dramatically harder target, and for most organizations that migration is an afternoon of work plus some grumbling.

Assume the session is the target

Even with better factors, plan for stolen sessions. That shifts effort toward things that limit what a token is worth: conditional access tied to managed devices, short session lifetimes for privileged roles, and revocation you have actually rehearsed.

Detection is not exotic either. A short list of high signal events covers a surprising share of real account takeovers:

New OAuth consent granted to an unfamiliar application
New inbox rule that forwards or deletes mail
MFA method added or changed shortly after a login from a new network
Successful login followed by mass file access or mail search

None of those require a large security team. They require someone to have decided, in advance, that these alerts page a human.

Practice the takeover before it happens

When a real compromise lands, the response is mechanical if you have written it down: revoke every session and refresh token, reset the credential, remove attacker inbox rules, review OAuth grants, then work outward through what the account touched. Teams that have run this once as an exercise resolve incidents in an hour. Teams doing it for the first time during the incident lose a day, and the attacker spends that day reading.

If you only do one thing this week

Require phishing resistant MFA on your admin accounts. Not the whole company, just the admins. It is the highest ratio of protection to effort available in identity security right now, and it turns the best current phishing kits back into spam.

If this is on your plate, TecLeads does exactly this as part of our Cybersecurity work. If you'd like a second pair of eyes on your setup, book a 30-minute call or explore what we do.