Why mobile-based MFA is not phishing resistant

The need for phishing-resistant MFA has become more apparent in recent times. Some experts estimate that as of 2020, spear phishing is linked to upwards of 95 percent of all successful attacks against organizational networks in both the private and public sectors. 2021 also saw some of the largest security breaches ever, including the Colonial Pipeline and SolarWinds hacks. In an attempt to address the growing threat, the White House released its cybersecurity executive order and Zero Trust Strategy with the Office of Management and Budget (OMB), mandating US federal agencies to use only multi-factor authentication (MFA) that can resist phishing attacks by the end of 2024. Today’s hackers increasingly hijack phishable one-time use codes and push notifications during the brief window when they are valid, and the attack and account takeover is all but invisible for the user.

With the recent spike in spear phishing using these methods, we decided to build on our previous work and show what it’s like to be phished with these modern techniques when using several types of basic multi-factor authentication.

If some of these terms are unfamiliar, don’t worry, we will go over them in this video.

Acknowledgements

These links have the details of the recent attacks. Krebs’ article in particular shows screenshots of some of the phishing pages used against several targets. Twitter was even quite open and posted publicly about their related security incident.

A different set of similar attacks happened over the last few years and are very serious. Amnesty International has three in-depth articles which detail phishing techniques used by seemingly politically motivated attackers against human rights defenders, journalists, and civil society organizations in the Middle East, Egypt, and Northern Africa during 2018 and 2019. This is a clear example of how attackers know their victims, and will use things they care about (security) to try and trick them.

Also not covered here are attacks on SMS based authentication where the phone network is leveraged via backbone connections or sim swaps to intercept the code that the victim was supposed to get. Read below to learn more about this:

The way I was able to make fairly clean phishing pages over the course of roughly a day was by using the open source phishing framework called Evilginx2 by Kuba Gretzky and hacking in some tweaks and javascript. If you’re interested in the details of how these attacks are done under the hood, or want to see some other great examples against other services, please see Kuba’s fantastic talk here.

Talk to our teamTalk to our team

Share this article:


  • Securing the skies with YubiKeys: Insights on cyber resilience in the aviation industry and beyondIn an increasingly interconnected world, the landscape of cybersecurity is constantly evolving. Bad actors are becoming more sophisticated, leveraging tactics like phishing and ransomware to exploit human error and weak credentials. This makes robust cybersecurity a universal issue, impacting everyone from individuals to the largest global enterprises – especially those in high-stakes sectors like commercial […]Read morecyber resilienceEUmanufacturingQ&A
  • Future-proofing authentication: A look at the future of post-quantum cryptographyThe path from passwords to passkeys and beyond In a previous blog I talked about the end of passwords and the rise of passkeys, which promise stronger security and less frustration for both individuals and businesses. The global momentum behind passkeys represents one of the most exciting shifts in authentication history, but realizing their full […]Read more
  • Goodbye master passwords: Dashlane and Yubico enhance credential vault encryption and login with YubiKeysAt Authenticate 2025 this week, the world’s leading experts on modern authentication and securing digital identities gathered, to discuss the future of secure authentication and achieving usable security across the account lifecycle. The message was clear: the future of phishing-resistant authentication is using passkeys for encryption, and the gold standard is device-bound passkeys – YubiKeys. […]Read morecredential vault encryptioncredential vault loginDashlanepartnerpasskey encryptionPRF
  • Piloting Europe’s future ID: Passkeys securing digital walletsOver the last several years, passkeys have become ubiquitous. They are available on every mobile platform, in every leading browser, as part of all major enterprise IAM solutions, and in most major cloud services. Until wwWallet came along, the only place where passkeys hadn’t yet made an impact is in the rapidly developing world of […]Read moredigital identity walletspasskeysSIROSwwWallet