TIP · 4 min read
Phishing-Resistant MFA in 10 Minutes
Adversary-in-the-middle kits like Evilginx and Tycoon eat TOTP and push MFA for breakfast. FIDO2 / WebAuthn is the only widely-deployed factor that breaks them. Here's the fast rollout.
Pick the right factor
Hardware security keys (YubiKey, Feitian) for admins; platform authenticators (Windows Hello, Touch ID, Android) for everyone else.
Block weak factors
Disable SMS and voice for privileged accounts. Conditional access: if factor != phishing-resistant, block.
- Mark FIDO2 as preferred in Entra/Okta
- Block legacy auth protocols
- Require key re-registration on suspicious sign-in
Plan the recovery flow
Lost-key recovery is where most rollouts leak. Pre-enroll two keys per admin and ship a verified helpdesk script.
Tools mentioned
YubiKeyEntra IDOktaDuo1Password
⟩ takeaway
If your MFA can be relayed by a proxy, it isn't MFA. Phishing-resistant means cryptographic origin binding — pick factors that ship it.
⟩ keep reading
Related articles
Mobile Malware in 2026: How It Gets In and How to Stay Safer
Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.
Phishing Defense That Actually Works
AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.
Splunk Detection Tips: From Noisy Alerts to Real-Time Signal
SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.