Phishing Bypassed MFA Through Real-Time Relay, Showing Why Passkeys May Be Safer

An accounting employee at a mid-sized company was tricked by an email leading to a fake Microsoft login page that mirrored the genuine one. She entered her password and then the real SMS code, which the attacker relayed in real time. The attacker used the stolen session to set up a rule forwarding invoices to an external Gmail address, and IT only noticed two days later. The attack is an adversary-in-the-middle technique that captures the session cookie, so MFA codes alone can be defeated. The article argues that phishing-resistant options such as passkeys are a stronger defense than OTP-based MFA.