Your MFA Has a Hole in It: Phishing-Resistant Authentication for Canadian SMBs in 2026

In October 2025, Microsoft Defender for Office 365 blocked more than 13 million malicious emails tied to a single phishing-as-a-service platform called Tycoon 2FA. Each email was designed to accomplish the same thing: let you complete your MFA challenge normally, then steal the authenticated session token generated afterward. The attacker never needed your password or your second factor. They waited for authentication to succeed, and took what came out the other side.

If that sounds like it bypasses multi-factor authentication entirely, that is because it does.

This attack class — adversary-in-the-middle (AiTM) phishing — has made a specific form of protection increasingly insufficient: one-time passwords, SMS codes, and push notification approvals. These methods are genuinely better than a password alone. They are no longer adequate as the primary authentication control for accounts that matter.

The Canadian Centre for Cyber Security detected more than 100 AiTM phishing campaigns targeting Canadian Microsoft Entra ID tenants between 2023 and early 2025. In April 2026, Microsoft Threat Intelligence published a detailed case study on a financially motivated actor it designates Storm-2755, notable specifically for geo-targeting Canadian employees — not by industry, but by country. The attack chain: malicious search ads drive Canadian victims to AiTM phishing pages, sessions are hijacked after MFA completes, and payroll deposits are redirected to attacker-controlled accounts while the actor maintains persistent access by refreshing stolen session tokens every eight hours.

This is not a theoretical threat. It is an active, documented threat specifically aimed at Canadian organizations.

How AiTM Phishing Works

Traditional phishing tries to steal your password through a fake login page. AiTM phishing is structurally different: the attacker stands between you and the real login server in real time.

When you enter your credentials into what appears to be a Microsoft 365 sign-in page, the AiTM proxy forwards them to the real Microsoft server. Microsoft sends back an MFA prompt — the AiTM infrastructure relays that to you as well. You approve it. Microsoft issues an authenticated session token. The proxy captures that token before it reaches your browser.

At that point, the attacker has something more valuable than your password: a live, authenticated session that does not require them to know your credentials or defeat your MFA method. They import it into a browser, and they are signed into your account as you.

Proofpoint's State of the Phish research found that 59% of accounts attackers successfully compromised already had MFA enabled. This is the number every Canadian SMB should sit with: your employees enabling MFA does not protect them from AiTM phishing. It protects them from credential stuffing, password spray, and brute force — attacks that remain common and worth defending against. But AiTM is a different attack, and it requires a different defence.

What Phishing-Resistant Authentication Actually Means

Not all MFA methods are equal in the face of AiTM. The category that stops this attack is called phishing-resistant MFA, and it works through a fundamentally different mechanism than one-time passwords or push notifications.

Phishing-resistant methods — FIDO2 security keys and passkeys — use public-key cryptography bound to the specific domain of the site you are logging into. When you authenticate with a passkey, your device performs a cryptographic operation that is only valid for the exact domain the browser is displaying. An AiTM proxy at `microsoftonline-auth.ca` cannot intercept an authentication that is cryptographically tied to `login.microsoftonline.com`. The math fails at the proxy, not at you.

The Canadian Centre for Cyber Security's guidance ITSM.30.031, published in October 2025, is explicit: the recommended defence against AiTM phishing campaigns is phishing-resistant MFA by default and without exception for accounts with access to sensitive data, financial systems, or administrative privileges. The CCCS identifies FIDO2 security keys and passkeys as the recommended methods.

The Microsoft Digital Defense Report 2025 quantifies the effect: phishing-resistant MFA blocks over 99% of identity-based attacks in Microsoft's telemetry. Of the identity attacks Microsoft observes, 97% are either password spray or brute-force — categories that phishing-resistant auth eliminates completely, along with AiTM.

Passkeys in Practice: Where Adoption Stands

A passkey is the same cryptographic FIDO2 credential that hardware security keys have provided for years, stored in a secure enclave the user already has: the Trusted Platform Module of a Windows laptop, the Secure Enclave of an iPhone or Mac, or a password manager synced across devices. The user authenticates with their device PIN or biometrics. No code to read, no push to approve, no phishing page that works.

According to the FIDO Alliance's State of Passkeys 2026 report, based on a survey of 11,000 consumers and 1,400 enterprise decision-makers across ten countries conducted in April 2026:

• An estimated 5 billion passkeys are now in active use worldwide
• 90% of consumers are now aware of passkeys — up from 75% the prior year
• 75% of consumers have enabled a passkey on at least one account
• 68% of organizations have deployed or are actively deploying passkeys for employee sign-ins
• Passkeys achieve a 93% login success rate, versus approximately 63% for traditional password-based methods

Microsoft Entra production data shows synced passkeys complete sign-ins 14 times faster than legacy MFA methods, with a 95% versus 30% completion rate improvement. This is not primarily a security argument — it is a user experience improvement that simultaneously eliminates the attack surface.

Why This Is Urgent for Canadian SMBs Right Now

Canadian SMBs face a particular risk concentration because Microsoft 365 — Exchange Online, SharePoint, Teams, OneDrive — is the platform the majority of Canadian businesses use for email, documents, and collaboration. Microsoft 365 accounts are the primary target of AiTM campaigns because the value on the other side of a successful session hijack is high: email access for business email compromise, OneDrive for ransomware staging, Teams for lateral movement through trust relationships, Workday integrations for payroll redirection.

Storm-2755 is not an anomaly. It is a documented instance of a pattern the CCCS and Microsoft have both identified independently: financially motivated actors specifically building infrastructure to target Canadian users through AiTM phishing chains that defeat standard MFA.

The Verizon 2026 Data Breach Investigations Report confirms stolen credentials remain the #1 initial access vector, accounting for 22% of all confirmed breaches analyzed. The IBM 2026 Cost of a Data Breach Report puts the average Canadian breach at CA$7.11 million — a record high. A single compromised administrator account, from a phishing email that arrived on an otherwise quiet Tuesday, can produce that outcome.

A Practical Rollout Sequence for Canadian SMBs

Enabling phishing-resistant MFA across a 20 to 150-person organization is a Microsoft Entra configuration task, not a major project. A phased approach minimizes disruption:

Phase 1 — Enable passkeys in Microsoft Entra (1–2 weeks)

Passkeys are supported on all Microsoft 365 plans at no additional licensing cost. In the Microsoft Entra admin centre, navigate to Protection → Authentication methods → Passkeys (FIDO2) → Enable. Users register at mysignins.microsoft.com/security-info using Windows Hello, iPhone Face ID or Touch ID, or a hardware FIDO2 key. No new hardware is required for the majority of users.

Phase 2 — Enforce phishing-resistant MFA for privileged accounts (2–4 weeks)

The CCCS recommends prioritizing administrator accounts, IT staff, finance team members, and executives — the accounts that carry the most damage potential if compromised. In Entra Conditional Access, create a policy targeting these roles that requires the built-in "Phishing-resistant MFA" authentication strength. Exclude a documented break-glass emergency account.

Phase 3 — Extend to all users and block legacy authentication (4–8 weeks)

Extend the Conditional Access authentication strength policy to all users. Add a second policy blocking legacy authentication protocols — Basic Auth, IMAP/POP3, SMTP AUTH — which bypass MFA entirely and remain a consistent foothold in breach timelines. These two Conditional Access changes together close the majority of the AiTM and credential-based attack surface.

What about employees not yet enrolled?

During transition, keep Microsoft Authenticator with number matching enabled as a fallback. Number-matching push notifications are not phishing-resistant, but they meaningfully raise the bar against prompt-bombing attacks compared to standard push approvals. The goal is full passkey enrollment; the migration takes weeks, not months, for most SMB environments.

Phase 4 — User awareness (ongoing)

Employees who understand how AiTM phishing works make better decisions when they encounter suspicious sign-in requests. A brief awareness session — explaining what a passkey is, why sign-in changed, and what an AiTM phishing attempt looks like — converts the technical control into a complete defence. The CCCS publishes free employee awareness materials on MFA and phishing that are worth adapting for your team.

The Business Case in Plain Numbers

The CCCS documented 100+ AiTM campaigns specifically targeting Canadian organizations. Microsoft has named and analyzed a financially motivated actor geo-targeting Canadian Microsoft 365 users. The IBM breach cost data puts the average Canadian incident at CA$7.11 million. The cost of the configuration changes above is measured in hours of IT time, not budget line items.

The gap is not technology. The technology is mature, free or already licensed, and actively supported by both Microsoft and the CCCS. The gap is prioritization — and the threat actors targeting Canadian organizations are counting on that gap staying open.

Sources

• Canadian Centre for Cyber Security. *Defending against adversary-in-the-middle threats with phishing-resistant multi-factor authentication (ITSM.30.031).* cyber.gc.ca (October 2025)
• Canadian Centre for Cyber Security. *Secure your accounts and devices with multi-factor authentication (ITSAP.30.030).* cyber.gc.ca
• Microsoft Security Blog. *Investigating Storm-2755: "Payroll pirate" attacks targeting Canadian employees.* microsoft.com (April 2026)
• FIDO Alliance. *Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026.* fidoalliance.org (May 2026)
• Microsoft. *Microsoft Digital Defense Report 2025.* microsoft.com
• Microsoft Learn. *Passkeys (FIDO2) authentication method in Microsoft Entra ID.* learn.microsoft.com
• Verizon. *2026 Data Breach Investigations Report.* verizon.com
• IBM. *Cost of a Data Breach Report 2026.* ibm.com
• Proofpoint. *State of the Phish: Annual threat intelligence report.* proofpoint.com
• Cybersecurity Canada. *Cybersecurity Canada Report 2026: The State of Canadian SMB Cybersecurity.* cybersecuritycanada.ca

Cloud Forces helps Canadian SMBs deploy phishing-resistant authentication — from Microsoft Entra passkey enablement and Conditional Access policy configuration to end-user awareness training and ongoing identity security monitoring. Explore our Cybersecurity services or contact us to start with an identity security assessment of your Microsoft 365 environment.