When "Phishing-Resistant" MFA Still Gets Bypassed

Week of 20 July 2026 | Compiled by Team Paringa

This week's identity news is a reminder that MFA strength isn't the same as MFA safety — attackers have simply found a cheaper way around it.

SECTION 1 — What Happened This Week

🔴 Forg365 puts AiTM session-token theft on a $400/month subscription

Researchers this week detailed Forg365, a new phishing-as-a-service platform targeting Microsoft 365 accounts that combines device-code phishing, adversary-in-the-middle session-token theft, anti-bot evasion, and AI-generated lures — sold via Telegram for $400 a month or $3,800 a year. The kit routes phishing traffic through legitimate email infrastructure such as Amazon SES and Twilio SendGrid to dodge spam filters, and hands buyers a post-compromise mailbox toolkit once a session token is captured.

Forg365 is the latest in a fast-growing category. Netcraft recently found the Bluekit PhaaS platform running roughly 70 live hostnames in a single week, and Huntress uncovered the EvilTokens kit actively targeting 340+ organisations using the same device-code technique. The common thread across all three: none of them try to defeat MFA head-on. They wait for the user to authenticate for real, on the real site, and then steal the session token the identity provider issues afterwards.

Microsoft's own telemetry shows the scale this has reached — a single AiTM campaign hit 35,000 users across 26 countries in three days. Separately, incident-response firm Obsidian Security found that MFA failed to prevent account takeover in 84% of the AiTM cases it investigated.

Sources: The Hacker News, Cyber Security News — Bluekit

This is the gap every "phishing-resistant MFA" vendor doesn't want spoken aloud: a passkey blocks classic reverse-proxy AiTM because the credential is cryptographically bound to the real domain — but device-code phishing tricks the user into completing a real login on the real site, so the credential signs without complaint. The only approaches that close this fully are ones where no credential exists to hand over in the first place. That's a materially different pitch to "stronger MFA," and it's the one worth leading with against Entra- and Okta-anchored prospects this quarter.

🟡 Session-token theft, not password theft, is now the primary account-takeover vector

Security teams are increasingly reporting that stolen session tokens — not passwords — are the actual currency of account takeover in 2026. Because a stolen token grants an already-authenticated session, it bypasses every step of the login flow, including step-up MFA, entirely. Analysts note that the fix isn't another factor bolted onto login; it's controls like token binding, continuous access evaluation, and rapid revocation that assume tokens will eventually leak.

Sources: Roundtable — AiTM Attacks: MFA Bypass & Session Token Theft, ThreatLocker — AitM phishing against Microsoft 365

If the token itself is the prize, the safest architecture is one where authentication never produces a durable, stealable credential or session artifact to begin with — not a stronger key, a different model entirely. Worth building into every identity conversation this quarter: ask the prospect what happens the moment a token leaks, not whether their MFA is "phishing-resistant" on paper.

SECTION 2 — What Identity and Security Leaders Are Dealing With

The industry spent three years telling security leaders that FIDO2 passkeys solve phishing. That's true against the attack pattern passkeys were designed for — but device-code phishing sidesteps the whole premise by getting the user to authenticate on the genuine site, then stealing what comes after. Buyers who adopted passkeys expecting the problem solved are now discovering a fresh blind spot, and vendors selling "stronger factors" are being forced to admit the factor was never the weak point — the credential and the session it produces are.

That reframing matters commercially: procurement conversations are starting to ask not "how strong is your MFA" but "what is there for an attacker to steal at all." Vendors whose architecture never issues a persistent, portable credential are best placed to answer that cleanly.

Three Things Worth Watching Next Week

1. Forg365 takedown attempts — Expect registrars and CDN providers to start pulling infrastructure once attribution firms publish full indicators of compromise.

2. Microsoft/Entra guidance updates — Watch for updated Conditional Access and token-binding guidance from Microsoft in direct response to the device-code phishing wave.

3. More named enterprise AiTM victims — With Bluekit, EvilTokens, and Forg365 all active concurrently, expect named breach disclosures tied to session-token theft within weeks.

Questions? hello@paringa.ai

Paringa's identity partners are built around a simple premise: if there's no credential to steal, AiTM and PhaaS kits have nothing to work with — a structurally different answer to the phishing problem than another authentication factor. | 20 July 2026 | © Paringa Ltd