# Oh, I use MFA! By Saad Khan 16 September 2026 3 min read On this page 1. Why Passwords and Passkeys Don’t Stop This 2. Closing the Gap CYBRT Sees Most Often 3. The Takeaway Passkeys were supposed to end phishing. A technique called device code phishing proves they didn’t, it just moved the attack to a layer nobody was watching. For years, the advice was simple: turn on MFA, and better yet, switch to passkeys, and phishing stops working. That advice just quietly stopped being true. Device code phishing, a technique that abuses a legitimate OAuth feature rather than stealing a password, has exploded from a niche, state-linked tool into a commodity criminal kit in under a year. Push Security measured a 37.5x rise in device code phishing pages in the first four months of 2026 alone. Huntress tracked a 1,380% jump in detections, with 344 organizations hit in a single wave by one phishing as-a-service kit called EvilTokens. Barracuda logged over 7 million attempts in a single four week stretch. At least 18 separate phishing kits now ship the technique as a standard feature. ### Why Passwords and Passkeys Don’t Stop This Device code phishing doesn’t try to steal a password or spoof a login page. It abuses the OAuth 2.0 device authorization grant, a legitimate feature built for devices without a normal browser, like a smart TV or CLI tool, so a user can sign in elsewhere and approve access with a short code. Attackers send a lure, often disguised as a document, voicemail, or the now-common “verify you’re human” ClickFix prompt, that walks the victim through entering a code on the real Microsoft or provider login page. The victim signs in on the genuine site and completes MFA for real. Nothing about the login is fake. The session token that gets issued afterward, however, lands on the attacker’s device instead of the victim’s. Since the attack targets authorization rather than authentication, it does not matter whether the victim used a password, an authenticator app, or a hardware passkey. All of them satisfy a login that was never actually theirs to approve. The numbers show why this matters beyond one clever technique. Proofpoint found that 59% of accounts taken over in 2026 had MFA enabled at the time. Obsidian Security reported that MFA failed to stop the attacker in 84% of the incidents it responded to. IBM’s 2026 Cost of a Data Breach Report puts phishing as the most expensive breach entry point at an average of $5.29 million. The control isn’t broken. Attackers simply stopped attacking it. ### Closing the Gap CYBRT Sees Most Often Most identity programs are built to strengthen the login screen: password complexity, MFA enforcement, and increasingly, passkeys. Very few are built to monitor what happens after login succeeds, which is exactly where this technique lives. This is the gap GRC and identity risk assessments increasingly need to test for directly rather than assume is covered, and it’s where firms like CYBRT are helping organizations across the Gulf move identity security past a login-screen checklist: **• Restrict or block the OAuth device code flow** through Conditional Access policies wherever it isn’t operationally required, since Microsoft itself now recommends disabling it by default. **• Treat session tokens as credentials**, with shorter token lifetimes and token-binding controls, so a stolen session can’t be replayed indefinitely. **• Monitor for device code sign-ins** from users or applications that never use them, and for refresh-token activity originating from unfamiliar locations. **• Test staff against real device code and ClickFix-style lures,** not just generic phishing templates, since the victim experience here looks completely legitimate. **• Build revocation into the incident response playbook,** so a suspected compromise triggers an immediate refreshtoken revocation, not just a password reset. ### The Takeaway Phishing-resistant MFA and passkeys were a genuine step forward, and they still stop the attacks they were designed for. But security built entirely around the login screen leaves the authorization layer wide open, and attackers noticed faster than most identity programs adapted. The real question isn’t whether your organization enforces strong authentication. It’s whether anyone would notice if a session token walked out the back door instead. How CYBRT can help ## Technology Consulting & Deployment End-to-end implementation of security technology that protects your infrastructure, applications and data. ## Keep reading Threats 26 Aug 2026 3 min read ### DeepFake: Is it really you? Deepfake video calls are now a working fraud method. How the scams work and the verification steps that protect your organisation. Threats 9 Dec 2025 5 min read ### SPF, DKIM and DMARC Explained: How to Stop Attackers Spoofing Your Domain How SPF, DKIM and DMARC work together, the records to publish, and a safe rollout plan that moves your domain to DMARC reject without blocking real email. Resilience 18 Oct 2026 7 min read ### Ransomware Response Plan for Saudi Organizations: The First 72 Hours A practical ransomware response plan for Saudi organisations: what to do in the first hour, day and 72 hours, including NCA reporting and PDPL notice. ## Ready to protect your business? Book your free security consultation today. --- Canonical page: https://cybrt.sa/oh-i-use-mfa/ Guide for AI agents: https://cybrt.sa/llms.txt