Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Русский
Entry № 918

Phishing-Resistant MFA

Что такое Phishing-Resistant MFA?

Phishing-Resistant MFAMFA methods that cryptographically bind authentication to the legitimate web origin — FIDO2/WebAuthn passkeys, smart cards, and Windows Hello — rendering AiTM proxy phishing, MFA fatigue, and OTP interception ineffective.

Phishing-resistant MFA is the category of authentication methods that cannot be intercepted, replayed, or tricked into authorizing the wrong relying party. The canonical examples are FIDO2 / WebAuthn (security keys, platform passkeys on Apple, Android, and Windows), PIV smart cards, and Windows Hello for Business. All of them share the same security property: the authenticator only generates a signature for the specific RP-ID (origin) it is presented with, so a credential registered with `login.example.com` cannot be coerced into signing a challenge from `login-evil.example.com`, even via a transparent AiTM proxy. They also defeat the lesser-but-common attacks that still work against TOTP and push-based MFA — MFA fatigue, push bombing, OTP-relay phishing kits (EvilProxy, Tycoon, Evilginx) — because there is no human-typed or human-tapped artifact for an attacker to relay. Major U.S. and European regulators (CISA, OMB M-22-09, ENISA, U.K. NCSC) have moved from 'use MFA' to 'use phishing-resistant MFA' guidance, and many enterprises now require it for privileged accounts and for any user accessing federated cloud services.

● Примеры

  1. 01

    A bank requires hardware FIDO2 keys for all admin users, eliminating the AiTM-phishing risk that previously affected TOTP and push-MFA accounts.

  2. 02

    U.S. Executive Order 14028 and OMB M-22-09 push federal civilian agencies to phishing-resistant MFA for all interactive logins by 2024.

● Частые вопросы

Что такое Phishing-Resistant MFA?

MFA methods that cryptographically bind authentication to the legitimate web origin — FIDO2/WebAuthn passkeys, smart cards, and Windows Hello — rendering AiTM proxy phishing, MFA fatigue, and OTP interception ineffective. Относится к категории Идентификация и доступ в кибербезопасности.

Что означает Phishing-Resistant MFA?

MFA methods that cryptographically bind authentication to the legitimate web origin — FIDO2/WebAuthn passkeys, smart cards, and Windows Hello — rendering AiTM proxy phishing, MFA fatigue, and OTP interception ineffective.

Как работает Phishing-Resistant MFA?

Phishing-resistant MFA is the category of authentication methods that cannot be intercepted, replayed, or tricked into authorizing the wrong relying party. The canonical examples are FIDO2 / WebAuthn (security keys, platform passkeys on Apple, Android, and Windows), PIV smart cards, and Windows Hello for Business. All of them share the same security property: the authenticator only generates a signature for the specific RP-ID (origin) it is presented with, so a credential registered with `login.example.com` cannot be coerced into signing a challenge from `login-evil.example.com`, even via a transparent AiTM proxy. They also defeat the lesser-but-common attacks that still work against TOTP and push-based MFA — MFA fatigue, push bombing, OTP-relay phishing kits (EvilProxy, Tycoon, Evilginx) — because there is no human-typed or human-tapped artifact for an attacker to relay. Major U.S. and European regulators (CISA, OMB M-22-09, ENISA, U.K. NCSC) have moved from 'use MFA' to 'use phishing-resistant MFA' guidance, and many enterprises now require it for privileged accounts and for any user accessing federated cloud services.

Как защититься от Phishing-Resistant MFA?

Защита от Phishing-Resistant MFA обычно сочетает технические меры и операционные практики, как описано в определении выше.

Какие есть другие названия Phishing-Resistant MFA?

Распространённые альтернативные названия: FIDO2 MFA, Origin-bound MFA.

● Связанные термины