6 min read
Rolling out phishing-resistant MFA (FIDO2 & passkeys) for cloud admins
Why SMS and standard push MFA fail against modern reverse-proxy phishing kits, and how to require WebAuthn/FIDO2 passkeys for privileged roles.
How Evilginx and AiTM proxies steal session cookies
Modern phishing kits proxy the real Microsoft or Google login page in real time. When an admin types a 6-digit TOTP code or approves a push prompt, the attacker captures the resulting session cookie.
FIDO2 security keys and device-bound passkeys cryptographically bind authentication to the legitimate browser origin (login.microsoftonline.com or accounts.google.com), making proxy theft impossible.
Enforce Authentication Strength in Entra ID & Google Admin
Both Microsoft Entra ID ("Phishing-resistant MFA" authentication strength) and Google Workspace ("Only security key" 2SV policy) let you require FIDO2 for administrative roles while allowing standard Authenticator push for general staff.
Free tool
Look up whether your sign-in is managed or federated →No sign-up required. Free Pistos Pharos utility.