WHY MFA IS GETTING EASIER TO BYPASS AND WHAT TO DO ABOUT IT

Summary from the TLDR InfoSec newsletter

Phishing-as-a-service toolkits allow criminals to bypass common multifactor authentication (MFA) through adversary-in-the-middle attacks. These tools create proxy servers that intercept credentials and MFA codes between victims and legitimate sites. While traditional MFA (one-time codes or push notifications) is vulnerable, WebAuthn-based authentication (passkeys) remains resistant because credentials are cryptographically bound to specific URLs and devices.