Real-Time MFA Phishing Turns One Click Into Org-Wide Breach
Global – October 20, 2026 -- Attackers are now capturing valid multi-factor authentication (MFA) codes in real time, so a single phishing click can give them full account access and a path into an entire organization, according to Chris Bentkowski, Service Engineer at CloudFit.
Fake login pages harvest passwords and live MFA codes
The typical attack starts when a user clicks a malicious link and lands on a fake login page that mimics a trusted application. The user enters a username and password, then a valid code from an authentication app. The attacker can then complete authentication, capture session details and potentially reconfigure or take control of MFA mechanisms. Bentkowski calls the technique MFA phishing, or token/session capture.