Your MFA Just Got Phished
Phishing kits are now defeating multi-factor authentication at scale — hijacking fully MFA-verified Microsoft 365 logins without ever touching a password. Why the second factor you trust isn't the finish line, and what actually resists phishing.
👋 Welcome to Unlocked
For a decade, the security advice was simple: turn on MFA. It was the single best thing most people could do. It still helps — but this month made something uncomfortably clear: the MFA most organizations rely on is now being phished at industrial scale.
In the week of July 20–26 alone, researchers tracked 7,295 phishing-as-a-service kit uploads, driven overwhelmingly by two techniques: adversary-in-the-middle (AiTM) proxies and OAuth device-code abuse. Both share a chilling property — they hijack a fully MFA-verified Microsoft 365 login without ever touching the user's password.
This isn't "MFA is useless." It's "the kind of MFA you probably deployed has a ceiling, and attackers just found it." This week we break down how they're getting past it, and what actually holds.
🔑 What's Actually Happening
Two plays dominate the current wave. In an adversary-in-the-middle attack, the victim is lured to a proxy page that sits invisibly between them and the real Microsoft login. They type their password, they approve the MFA prompt — and the proxy quietly captures the resulting session token. The attacker replays that token and is now logged in as the user, MFA and all. The password was never the point; the session was.
The second play abuses the OAuth 2.0 device-code flow — the mechanism built for signing a smart TV or CLI into your account. A kit dubbed EvilTokens weaponizes it: the attacker starts a legitimate login, sends the victim the real Microsoft prompt, and the victim, believing it's routine, approves. The attacker walks away with valid, MFA-blessed tokens. Device-code phishing has jumped 1,380% in recent measurement periods.
The common thread: attackers aren't cracking your factor. They're getting you to complete it for them — and it's now sold as a subscription, alongside kits that harvest credentials at scale, so no real skill is required.
📉 The Numbers
- 7,295 — phishing-as-a-service kit uploads tracked in a single week (July 20–26, 2026).
- 1,380% — increase in device-code phishing across recent measurement periods.
- $0 passwords needed — AiTM and device-code attacks steal the session, not the secret.
- Microsoft 365 — the identity platform these kits overwhelmingly target.
- Phishing-as-a-service — the delivery model turning MFA bypass into a point-and-click subscription.
🔍 Why MFA Isn't the Finish Line
1. AiTM steals the session, not the password.
Traditional MFA proves you're you at the moment of login. But once that produces a session token, whoever holds the token is "you" until it expires. An AiTM proxy simply relays your real login and pockets the token at the end. Every step looked legitimate — because it was.
2. The device-code flow turns your own login against you.
Because the victim approves a genuine Microsoft prompt, there's no fake domain to spot and no password to mistype. The design that makes signing in a TV convenient is the same design that lets an attacker borrow your approval. Convenience and exploitability are the same feature here.
3. It's commoditized.
These aren't bespoke nation-state operations. They're subscription kits with dashboards. When bypassing MFA is a point-and-click purchase, the volume doesn't just rise — it floods, which is exactly what the 7,295-upload week shows.
🛡️ What This Means for Your Access Layer
Move high-value access to phishing-resistant MFA.
Not all MFA is equal. Passkeys and FIDO2 security keys are cryptographically bound to the real site's origin and to the user's device — so an AiTM proxy can't relay them and a stolen code is meaningless. This is the category that actually resists the attacks above. (Our guide to hardware authentication covers how it works, and it's the model behind EveryKey.)
Retire codes and push for your crown jewels.
SMS codes, authenticator codes, and push approvals are all phishable — they rely on a human relaying or approving something. Keep them if you must for low-risk apps, but don't let them guard admin consoles, finance, or identity providers.
Lock down the OAuth device-code flow.
Most organizations don't actually need device-code sign-in enabled everywhere. Restrict it with conditional-access policies, and alert on device-code grants from unexpected locations or for high-privilege accounts.
Shorten and bind sessions.
If the token is the prize, make it a smaller one: shorter session lifetimes, token binding where supported, and step-up re-authentication for sensitive actions all shrink the value of a stolen session.
🔑 The Bottom Line
MFA was never supposed to be the last word — it was supposed to buy time against password theft, and it did. But the attack moved. It's no longer about your password or even your code; it's about the session those things unlock.
The fix isn't "more MFA," it's phishing-resistant MFA — credentials an attacker can't relay, approve on your behalf, or replay. Everything else is a speed bump attackers have learned to drive over.
💡 Unlocked Tip of the Week
Ask your team one question this week: "If an employee got proxied through a fake Microsoft login today, would anything we've deployed actually stop it?"
If the honest answer is "we'd be relying on them spotting the page," you're relying on a coin flip. Phishing-resistant credentials are the control that doesn't depend on the human getting it right.
🔥 Final Takeaway
We spent ten years teaching people to approve the prompt. Attackers just turned that reflex into the exploit.
7,295 kits in a week. A 1,380% jump in device-code phishing. MFA-verified logins hijacked without a single stolen password. None of it breaks cryptography — it borrows your approval and pockets your session.
The organizations that come through this in better shape won't be the ones who "turned on MFA." They'll be the ones who moved the factor that matters to something an attacker can't phish, proxy, or replay — access bound to hardware and to the real site, not to a code a human can be tricked into handing over.
The prompt you approve on autopilot is the new front door. Make sure it opens for you and no one else.
Stay ready. Stay resilient.
Until next time,
← Last Week: The Firms That Audit Everyone Just Got Breached
📚 Sources & Related Reading
This week's sources:
- CybersecurityNews — Top 10 Phishing Kits Used by Hackers (July 20–26, 2026)
- IT Security Guru — AI-Powered Phishing Surges 1,380% as Criminal Platforms Render MFA Obsolete
- GBHackers — Weekly Cybersecurity Newsletter: Top Stories, July 20–24, 2026
More from Unlocked:
