Adversary-in-the-middle phishing kits proxy a real login page and capture both the password and the one-time code. Number matching helps, but passkeys and FIDO2 keys are bound to the real website and cannot be relayed.
Where to start:
- Require phishing-resistant MFA for admins first
- Enable passkeys in Microsoft Authenticator
- Block sign-ins from unmanaged devices for sensitive apps
Book a free consultation to have Glacyn apply this to your business.