Why Traditional Two-Factor Authentication Is No Longer Enough?

Multi-Factor Authentication (MFA) is an essential measure to protect environments such as Microsoft 365 and Microsoft Entra from cyber threats. 


However, the effectiveness of traditional MFA has declined in recent years due to the evolution of more sophisticated attack techniques, such as Adversary-in-the-Middle (AiTM). These attacks can compromise even accounts protected by MFA.
 

What Is an Adversary-in-the-Middle (AiTM) Attack?

Adversary-in-the-Middle (AiTM), also known as “man-in-the-middle,” is an advanced phishing technique where an attacker secretly intercepts and manipulates communication between a user and a service (e.g., Microsoft 365) without either party noticing. Today, attackers can intercept authentication tokens in real time, bypassing MFA and gaining unauthorized access to accounts.
                                                                         
Traditional MFA methods fail because they are not tied to specific hardware and do not require physical proximity. If a user is tricked into approving an MFA request, the token can be intercepted and reused by an attacker on another device.
 

How to Protect Your Business Against AiTM Attacks 

• Implement Phishing-Resistant MFA 

The best way to prevent attacks that exploit weaknesses in traditional MFA is to adopt stronger authentication methods that cannot be easily replicated by attackers. In Microsoft 365, three key options stand out:

• Security Keys: A “digital key” stored in an app (such as Microsoft Authenticator) or on a physical device.
• Windows Hello or Platform Credential (macOS): Uses the user’s own computer or phone with PIN, facial recognition, or fingerprint.
• Digital Certificates: Act as a “digital ID card” that only the organization can issue and validate.

 

• Require Compliant Devices 

Implement Conditional Access policies to ensure that only devices meeting the organization’s security requirements can access resources.
 

• Enable Number Matching and Additional Context in Microsoft Authenticator

Enhance security by using the Microsoft Authenticator app, which is more reliable than other methods. Enable number matching to prevent users from approving login requests by mistake. Display additional information during authentication, such as the app name or request location, so users can identify whether the access attempt is legitimate or suspicious.
 

• Apply Risk-Based Access Controls

Use Conditional Access policies to assess sign-in risk and apply additional measures such as MFA, password reset, or access blocking.
 

• User Education

Raising user awareness is critical. Employees should be trained to recognize phishing attempts and other malicious activities. They need to identify suspicious links and emails, understand when they are being targeted by phishing or social engineering, and appreciate the importance of using strong authentication methods to protect their accounts.

If you need support to protect your business, contact Hydra iT!