"We have multi-factor, so we're covered." It is one of the most common things we hear from small businesses, and a year or two ago it was close to true. It is less true now.
While multi-factor authentication remains the single most valuable security control a small business can turn on, attackers have adapted to it. The newer phishing kits no longer try to steal your password and stop there. They steal what you get after you sign in. That distinction matters, and it is worth understanding before it becomes expensive.
How the attack works
Known as adversary-in-the-middle phishing, the technique puts a fake login page between your employee and the real one. The page looks right because it is passing everything straight through to Microsoft or Google in real time.
The employee enters their password. The fake page forwards it. Microsoft sends the usual multi-factor prompt, the employee approves it on their phone, and the sign-in succeeds. From their side, nothing looked wrong. They signed in exactly the way they always do.
Behind the scenes, the fake page has kept the session token, the thing that tells Microsoft "this person has already signed in." With that token, the attacker can open the mailbox without a password and without a prompt. Multi-factor did its job. It just did it for the wrong person.
The usual next steps are quiet. A forwarding rule gets added so the attacker sees new mail. A few invoices get read. Then a payment request goes out to a client, from a real mailbox, inside a real thread.
What actually closes the gap
None of this means multi-factor was a waste. Without it, the attacker would not have needed a phishing kit at all. However, it does mean the job is not finished once the authenticator app is installed.
Phishing-resistant sign-in for the accounts that matter most. Passkeys and hardware security keys are tied to the real website's address. A fake login page cannot use them, because the key refuses to answer a site it was never registered with. Rolling them out to everyone at once is a project. Rolling them out to administrators and anyone who approves payments is an afternoon, and those are the accounts attackers want first.
Conditional access. Rather than trusting every sign-in that passes multi-factor, conditional access asks better questions: is this a company device, is it coming from a country you work in, does the sign-in look risky? A session token replayed from an unfamiliar device in another country gets blocked. In Microsoft 365, conditional access is included in Business Premium, which many small businesses already pay for without using it.
Alerts on the quiet steps. New forwarding rules, new inbox rules that move or delete mail, and sign-ins from unusual locations should all reach someone who will look at them. Attackers depend on nobody noticing for a few days. Taking those days away is often what turns a fraud into a near miss.
Smaller habits that help
Number matching on authenticator prompts stops people approving a request they did not start. A short session lifetime on unmanaged devices limits how long a stolen token stays useful. And teaching staff one specific thing, that a login page reached from an email link is always worth a second look, does more than general warnings about being careful.
Our verdict
Multi-factor authentication is still the first thing we would turn on in any small business, and anyone who has not enforced it everywhere should start there today. With that being said, treating it as the finish line is exactly what these phishing kits are built to exploit. The businesses that come through this well are the ones that layered conditional access and phishing-resistant keys on top, and set up the alerts that catch a compromised mailbox in hours rather than weeks.
The cost of doing that now is a few hours of configuration. The cost of skipping it shows up later, usually as a payment that went somewhere it should not have.
Setting this up properly is part of our security and insurance readiness work, and the insurance-readiness review checks where your sign-in settings stand today.
Related guides
- Before anyone turns on Copilot, fix who can see whatAI tools respect your permissions. That is the problem if your permissions are a mess.
- How to budget for IT in 2027 without guessingFive lines that turn next year's IT spend from a guess into a number.
- What to check before the Thanksgiving long weekendLong weekends are when nobody is watching. Six checks to run on Friday afternoon.