Global – October 20, 2026 -- Attackers are now capturing valid multi-factor authentication (MFA) codes in real time, so a single phishing click can give them full account access and a path into an entire organization, according to Chris Bentkowski, Service Engineer at CloudFit.
Fake login pages harvest passwords and live MFA codes
The typical attack starts when a user clicks a malicious link and lands on a fake login page that mimics a trusted application. The user enters a username and password, then a valid code from an authentication app. The attacker can then complete authentication, capture session details and potentially reconfigure or take control of MFA mechanisms. Bentkowski calls the technique MFA phishing, or token/session capture.
Compromised accounts become launchpads for lateral movement
After sign-in, attackers establish persistence, compromise further user accounts, introduce unauthorized systems and expose systems to the internet. They also exploit the trust attached to the hijacked account. They send phishing emails to coworkers and external contacts, share malicious files disguised as legitimate documents, and create access pathways such as guest accounts or shared links. Because the messages come from a trusted internal sender, recipients are more likely to click.
Remediation spans IT, security and business teams
Affected organizations may have to reset multiple user accounts and MFA configurations, remove unauthorized systems and access, delete malicious emails and files, and investigate malicious activity across the environment. Timely response can often contain an incident, Bentkowski notes. Recovery from a successful credential and MFA compromise still demands significant effort across IT, security and business functions.
Recommended defenses center on user verification and fast reporting
CloudFit's guidance tells users to sign in only through known URLs and to avoid logging in via links in unexpected messages. It treats MFA codes as sensitive as passwords, so they should never be entered on untrusted pages. Red flags include unexpected login prompts, urgent requests to "verify your account," unfamiliar file-sharing notifications and emails that create pressure. Users who may have entered credentials on a malicious site should notify IT or security teams immediately, since faster reporting speeds containment.