Add Modern MFA Attack Patterns and Mitigations Section by sujalavnelavai · Pull Request #2244 · OWASP/CheatSheetSeries

sujalavnelavai · 2026-06-22T16:01:00Z

This update adds a new subsection covering modern MFA bypass techniques, including:

Real-Time Phishing (AiTM)
SIM Swap & Phone Number Takeover
Token Theft & Session Hijacking
Device Binding Bypass
MFA Downgrade Attacks (OAuth/SSO)

Each attack pattern includes concise mitigations and authoritative references from NIST, CISA, Microsoft, Google, FIDO Alliance, Trusted Computing Group, and Apple.

The section aligns with current industry guidance on phishing-resistant MFA, device attestation, and assurance-level enforcement.

I have independently verified every citation and technical claim against the cited source.

You're A Rockstar

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

In case of a new Cheat Sheet, you have used the Cheat Sheet template.
All the markdown files do not raise any validation policy violation, see the policy.
All the markdown files follow these format rules.
All your assets are stored in the assets folder.
All the images used are in the PNG format.
Any references to websites have been formatted as [TEXT](URL)
You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
The CI build of your PR pass, see the build status here.

Scope and sourcing (required)

This PR is focused: it modifies a single cheat sheet, or a small coordinated set, and the scope is described in the PR body.
Every technical claim, recommendation, or threat assertion added in this PR is supported by a primary source (RFC, NIST, OWASP standard, vendor documentation, peer-reviewed research) linked inline as [text](URL).
I have read each source I cite and confirm it actually supports the claim. I have not relied on summaries, hearsay, or model-generated citations.

If your PR is related to an issue, please finish your PR text with the following line:

This PR fixes issue #2229 `.

AI Tool Usage Disclosure (required for all PRs)

Please select exactly one of the following options. PRs that leave this section blank will be closed.

I have NOT used any AI tool to generate the contents of this PR.
This update adds a new subsection covering modern MFA bypass techniques, including:
Real-Time Phishing (AiTM)
SIM Swap & Phone Number Takeover
Token Theft & Session Hijacking
Device Binding Bypass
MFA Downgrade Attacks (OAuth/SSO)

Each attack pattern includes concise mitigations and authoritative references from NIST, CISA, Microsoft, Google, FIDO Alliance, Trusted Computing Group, and Apple.

The section aligns with current industry guidance on phishing-resistant MFA, device attestation, and assurance-level enforcement.

I have independently verified every citation and technical claim against the cited source.

I have used AI tools to generate the contents of this PR. I have verified
the contents and I affirm the results. The LLM used is "Microsoft Copilot (2026)"
and the prompt used is "Assist me in reviewing the Multifactor Authentication
Cheat Sheet, drafting updated text for modern MFA attack patterns, and helping
me format citations and references clearly." I have independently verified every
citation and technical claim against the cited source.
[Feel free to add more details if needed]

Thank you again for your contribution 😃

This update adds a new subsection covering modern MFA bypass techniques, including: - Real-Time Phishing (AiTM) - SIM Swap & Phone Number Takeover - Token Theft & Session Hijacking - Device Binding Bypass - MFA Downgrade Attacks (OAuth/SSO) Each attack pattern includes concise mitigations and authoritative references from NIST, CISA, Microsoft, Google, FIDO Alliance, Trusted Computing Group, and Apple. The section aligns with current industry guidance on phishing-resistant MFA, device attestation, and assurance-level enforcement. No existing content was modified outside this new subsection.

Added updated references

randomstuff · 2026-06-26T09:56:00Z

+**Mitigations:**
+
+- Enforce **Number Matching** / Challenge-Response to break the "Approve" loop.
+- CISA – Phishing Guidance: Stopping the Attack Cycle at Phase One.[CISA]( https://www.cisa.gov).


Explain this? (I don't understand it as it stands).

Also include the link in the first "CISA" instance?

Thanks for the review. I’ve clarified the mitigation text. Also, regarding the CISA reference — CISA does not actually describe or recommend "Number Matching." That feature is specific to Microsoft Authenticator. I’ve updated the wording so it no longer implies a CISA connection and added a clearer explanation of the mitigation itself.

randomstuff · 2026-06-26T09:56:32Z

+
+- Enforce **Number Matching** / Challenge-Response to break the "Approve" loop.
+- CISA – Phishing Guidance: Stopping the Attack Cycle at Phase One.[CISA]( https://www.cisa.gov).
+- Strictly rate-limit and lock out MFA prompts after repeated unapproved attempts ([OWASP ASVS v4.0](https://owasp.org/www-project-application-security-verification-standard/)).


Link TO ASVS5.0 ? :) Also deep link to ASVS specific requirement.

randomstuff · 2026-06-26T10:26:52Z

+
+### Real-Time Phishing (Adversary-in-the-Middle / AiTM)
+
+Attackers use reverse-proxy tools (e.g., Evilginx) to intercept credentials and standard MFA tokens (SMS, TOTP) in real-time.


Maybe some more explanations are needed. It looks like you talk about MITM the connection with the target website but I believe you actually want to automate impersonation about the target web site?

Thanks for the feedback. I’ve clarified the description. The intent is to describe AiTM phishing kits that proxy the user’s session to the real site and capture the authenticated session cookies, enabling automated impersonation. I’ll update the text to make that distinction clearer.

randomstuff · 2026-06-26T10:27:15Z

+**Mitigations:**
+
+- Mandate **Phishing-Resistant MFA** (FIDO2 / WebAuthn) which cryptographically binds the authentication to the origin URL ([CISA Phishing Guidance](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf)).
+- Implement risk-based authentication to block known VPN/proxy IP spaces and impossible travel ([CISA. Zero Trust Maturity Model, Identity Pillar](https://www.cisa.gov/zero-trust-maturity-model).


Does this actually help in this case?

Good point. Phishing‑resistant MFA directly mitigates AiTM because the authentication is origin‑bound. Risk‑based authentication doesn’t stop AiTM itself, but it can detect suspicious access patterns after the attacker attempts to reuse the stolen session. I’ll adjust the wording to reflect that distinction.

randomstuff · 2026-06-26T10:29:45Z

+- **Deprecate Telephony MFA** for high-privilege accounts ([NIST SP 800-63-4](https://pages.nist.gov/800-63-4/sp800-63.html)).
+- Default to TOTP authenticator apps or FIDO2 hardware keys.
+
+### Token Theft & Session Hijacking


"Impossible travel" detection would be useful in this case?

Yes- impossible travel is useful here, but only as a detection mechanism after a stolen token is replayed from a different location. I’ll clarify that it’s a post‑compromise signal rather than a preventative control.

randomstuff · 2026-06-26T10:30:03Z

+**Mitigations:**
+
+- Implement **Continuous Access Evaluation (CAE)** with short-lived tokens ([Microsoft CAE Documentation](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation)).
+- Enforce strict cookie flags (`HttpOnly`, `Secure`, `SameSite=Strict`) and bind sessions to device hardware.


I would split this bullet point in two.

Agreed - these are separate mitigations. I’ll split them into two bullets.

randomstuff · 2026-06-26T10:31:22Z

+**Mitigations:**
+
+- Store device identity keys strictly in non-exportable hardware modules (TPM or Secure Enclave).
+- Require OS-level platform attestation (e.g., Android Play Integrity, iOS DeviceCheck) before granting access.


I really don't believe this is really useful for security. On the other hands, this is real PITA for actual users, harmful for interoperability.

And it blocks actual legitimate users who don't want to use Google or Apple OS from using the MFA solution. This is therefore actually harmful for security, an issue for society in general and a problem for sovereignty (which is ultimately a problem for security).

Understood - that’s a fair point. Platform attestation is highly vendor‑specific and can introduce interoperability and accessibility issues. I’ll remove this mitigation to keep the guidance vendor‑neutral and broadly applicable.

Updated references under the section "MFA Fatigue Attacks"

Added detailed explanations and updated references for some sections in Modern MFA attack patterns

Corrected markdown lint error.

sujalavnelavai added 11 commits June 22, 2026 15:35

Update Multifactor_Authentication_Cheat_Sheet.md

01de012

Update Multifactor_Authentication_Cheat_Sheet.md

b037d37

Update Multifactor_Authentication_Cheat_Sheet.md

5eabbbb

Update Multifactor_Authentication_Cheat_Sheet.md

f0a63e1

Update Multifactor_Authentication_Cheat_Sheet.md

119d975

Update Multifactor_Authentication_Cheat_Sheet.md

ea93568

Update Multifactor_Authentication_Cheat_Sheet.md

152f566

Update Multifactor_Authentication_Cheat_Sheet.md

2a58200

Update Multifactor_Authentication_Cheat_Sheet.md

52a3c41

Added updated references

Update Multifactor_Authentication_Cheat_Sheet.md

1790b49

randomstuff reviewed Jun 26, 2026

View reviewed changes

sujalavnelavai added 4 commits June 26, 2026 11:47

Update Multifactor_Authentication_Cheat_Sheet.md

cf086df

Updated references under the section "MFA Fatigue Attacks"

Update Multifactor_Authentication_Cheat_Sheet.md

6159b97

Added detailed explanations and updated references for some sections in Modern MFA attack patterns

Update Multifactor_Authentication_Cheat_Sheet.md

826f7e4

Corrected markdown lint error.

Update Multifactor_Authentication_Cheat_Sheet.md

20f8c0a


		### Real-Time Phishing (Adversary-in-the-Middle / AiTM)

		Attackers use reverse-proxy tools (e.g., Evilginx) to intercept credentials and standard MFA tokens (SMS, TOTP) in real-time.

Uh oh!

Conversation

sujalavnelavai commented Jun 22, 2026

You're A Rockstar

Scope and sourcing (required)

AI Tool Usage Disclosure (required for all PRs)

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

randomstuff Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

randomstuff Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

randomstuff Jun 26, 2026 •

edited

Loading

randomstuff Jun 26, 2026 •

edited

Loading