Vol. 2 of 25
·
Attacker tactics and validation
Network-delivered codes offer false security
SMS and push codes are perceived as a meaningful second layer of defence. Today, attackers have access to industrialised interception tools. The channel was never the defence. The shared secret is the weakness.
76%
Increase in AI-driven phishing tools designed to intercept codes sent over the network, over the twelve months leading up to Q1 2026. Source: HYPR / S&P Global.
53%
Proportion of security leaders who now view generative AI as their primary identity-related concern, overtaking stolen credentials for the first time. Source: HYPR / S&P Global.
98.4%
Reported reduction in account takeovers within one quarter of full FIDO2 rollout.
The assumption
One-time codes via SMS or push notifications are sufficient second factors against account takeover. Security teams often view SMS codes or push approvals in an authenticator app as a clear improvement over passwords alone, reporting MFA as implemented for compliance purposes.
The reality
Attackers have industrialised the interception of codes transmitted over networks. Adversary-in-the-middle (AiTM) tools, such as Evilginx, act as reverse proxies: the user logs in as usual and the tool captures the session cookie. The attacker never needs the code. SIM swapping requires no victim interaction at all. In MFA fatigue attacks, repeated push notifications prompt users to eventually approve access.
Target architecture
Transition to a phishing-resistant architecture by binding authentication to a hardware root of trust. Security keys sign challenges using a private key that never leaves the device. The signature is bound to the exact origin (domain) at protocol level. On a phishing proxy, the origin does not match, so the security key refuses to sign.
Three attack vectors blocked by FIDO2
AiTM phishing: No valid credentials are generated for a proxy domain. There is no session to steal.
SIM swapping: Without an SMS channel, porting a phone number provides no access.
MFA fatigue: There is no push notification to approve. Authentication requires a physical touch on the security key.
Three-phase implementation
Phase 1 (days 1–30): Issue security keys to privileged accounts: domain administrators, payment approvers, and executives.
Phase 2 (days 31–90): Roll out FIDO2 passkeys to remaining staff, using centralised distribution and enrolment.
Phase 3 (day 90 onwards): Deprecate SMS codes and push MFA. Retain them only for legacy integrations, with documented sunset dates.
SMS codes unlikely to withstand a post-incident NIS2 audit
NIS2 Article 21 requires essential and important entities to use MFA or continuous authentication where appropriate. Supplementary guidance expects phishing-resistant MFA for high-risk access. FIDO2 security keys satisfy requirements for phishing-resistant MFA using hardware-bound authenticators.
Sources
HYPR / S&P Global, State of Passwordless Identity Assurance 2026
MITRE ATT&CK T1557 (AiTM)
IBM X-Force Threat Intelligence Index 2025
Microsoft Digital Defense Report 2023
Would you like to assess your environment?
Book a walkthrough with Ciptor. We will review your assumptions together.
Book a walkthrough