I'm trying to understand how MFA protects against a phishing scenario where an attacker sends a malicious link leading to a fake Microsoft 365 login page. The victim enters their username and password, while the attacker relays those credentials to the real sign-in page and displays the resulting MFA prompt back to the victim. If the victim approves a push notification or enters a code, the attacker's relayed session could become authenticated.
Is this attack actually possible with methods such as one-time passwords or Microsoft Authenticator push notifications? If so, what prevents it, and which controls—such as passkeys, security keys, managed devices, conditional access, or IP restrictions—are effective defenses?
4 Answers
Yes, the attack you described is commonly called adversary-in-the-middle phishing. Traditional OTPs and push-based MFA can sometimes be relayed because the attacker is proxying the real login and capturing the resulting session. MFA is still useful against password-only attacks, but it is not automatically phishing-resistant.
The strongest general defense is phishing-resistant authentication, such as FIDO2 security keys, passkeys, or WebAuthn. These methods bind the authentication challenge to the genuine website’s origin, so a credential used on a fake domain cannot be successfully relayed to the real service. They are a much better fit for high-risk accounts than SMS, OTP codes, or push approval alone.
User awareness helps, but it should not be the only control. Staff will eventually encounter convincing phishing pages, so organizations should reduce unnecessary sign-ins, provide clear reporting procedures, monitor sign-in and audit logs, and quickly revoke sessions when suspicious activity is detected. Number matching can reduce accidental push approvals, but it does not provide the same protection as WebAuthn or a security key.
Add other access conditions as defense in depth. Conditional Access can require an Intune-enrolled and compliant device, restrict access by location or network where appropriate, require certificates, and use token-protection features when supported. Those controls can make stolen credentials and a relayed MFA session useless unless the attacker also has an approved device and environment.
Managed-device requirements are especially useful for business systems, although they can reduce convenience for people working from personal devices or while traveling.
The attacker may also be able to obtain the authenticated session cookie, which lets them bypass the normal login step until that session is revoked or expires.